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Chapter  1 


Introduction 

Alexander  H.  Levis 

The  initial  objectives  of  the  “Computational  Modeling  of  Cultural  Dimensions  in  Adversary  Or¬ 
ganizations”  were: 

(a)  To  relate  an  adversary ’s  organizational  structure  to  behavior  when  both  structure  and 
behavior  are  conditioned  by  cultural  and  social  characteristics,  as  they  always  are  in  rea¬ 
listic  settings. 

(b)  To  address  basic  research  questions  centered  on  locating  the  points  of  influence  and  cha¬ 
racterizing  the  processes  necessary  to  influence  organizations  in  diverse  cultures. 

(c)  To  explore,  through  a  computational  modeling  framework,  the  nexus  between  data  and 
models  for  individual  adversaries  (micro  level)  and  data  and  models  for  organizations  of 
adversaries  (macro  level). 

As  the  project  evolved,  additional  objectives  were  introduced: 

(d)  (d)  To  explore  multi-modeling  as  a  way  to  model  adversary  behaviors  and  research  the 
underlying  theory  (meta-modeling) 

(e)  (e)  Demonstrate  the  approach  through  a  case  study  that  addresses  issues  of  deterrence 
A  set  of  tasks  was  defined  for  achieving  the  these  objectives.  They  were: 

Task  1:  Implement  a  testbed  for  computational  modeling. 

Task  2:  Expand  and  enhance  the  existing  models  at  George  Mason  University’s  System  Ar¬ 
chitectures  Laboratory  (GMU/SAL)  and  at  Carnegie  Mellon  University’s  Center  for 
Computational  Analysis  of  Social  and  Organizational  Systems  (CMU/CASOS) 

Task  3:  Conduct  computational  experiments  to  address  the  set  of  research  hypotheses. 

Task  4:  Develop  and  transition  theory-based  tools  to  the  Air  Force 

Task  5:  Provide  Education  and  Training 

Task  6:  Meta-Modeling  for  Multi-Modeling  Integration 

Task  7:  Demonstration  of  Computational  Experiment 

Task  8:  Management  and  Documentation 

All  tasks  were  carried  out  during  the  period  of  performance.  In  this  report,  the  research  ap¬ 
proach  taken  and  results  obtained  in  Tasks  1,  2,  6,  and  7  are  presented.  The  many  transitions  of 
the  tools  that  have  taken  place  (Task  3)  have  been  reported  in  detail  in  the  annual  productivity 
reports  and  in  the  annual  program  reviews.  Similarly,  a  substantial  education  and  training  effort 
has  been  made  by  both  collaborating  organizations  through  the  training  on  many  graduate  re¬ 
search  assistants,  the  conduct  of  summer  institutes  (CMU),  the  offering  of  AFCEA  sponsored 
short  courses  (GMU)  to  DOD  personnel  and  staff  of  the  Defense  Industrial  Base,  as  well  as  nu- 


3 


merous  seminars  and  presentations  to  Air  Force  and  other  defense  organizations.  Much  of  the 
research  material  is  now  included  in  graduate  level  courses  at  both  universities.  Task  8  has  also 
been  reported  annually  to  the  Air  Force  office  of  Scientific  Research  in  accordance  with  grant 
requirements. 

Since  1992  the  nature  of  military  operations  has  changed.  The  type  of  objectives  that  the 
military  has  to  address  has  expanded  well  beyond  those  of  traditional  major  combat  operations. 
As  military  operations  became  other  than  conventional  war  -  whether  against  transnational  ter¬ 
rorist  threats  or  conducting  stabilization  operations  -  the  need  to  broaden  the  focus  of  models 
that  support  effects  based  planning  and  operations  became  critical.  One  major  weakness  was  the 
absence  of  socio-cultural  attributes  in  the  models  used  for  Course  of  Action  selection  and  effects 
based  planning.  Part  II  of  this  report  illustrates  an  approach  that  enables  analysts  to  evaluate 
complex  situations  such  as  those  in  which  an  adversary  is  embedded  in  a  society  from  which  he 
is  receiving  support.  In  Chapters  2  and  3,  a  modeling  approach  is  described  that  enables  analysts 
to  examine  and  explain  how  actions  of  the  military  and  other  entities  may  result  in  desired  or  un¬ 
desired  effects,  both  on  the  adversary  and  on  the  population  as  a  whole.  First,  Timed  Influence 
Nets  are  described  (Ch.  2)  and  then  the  theory  that  underlies  them  as  well  as  some  major  exten¬ 
sions  of  the  theory  are  presented  in  Chapter  3.  A  comprehensive  theory  of  Influence  Networks  is 
presented  that  incorporates  design  constraints  for  consistency,  temporal  issues  and  a  dynamic 
programming  evolution  of  the  Influence  Constants.  A  software  implementation  of  Timed  Influ¬ 
ence  nets,  a  modeling  and  analysis  tool  called  Pythia,  is  described  in  Appendix  B.  This  tool  has 
been  distributed  widely  to  military  and  intelligence  organizations.  One  of  the  difficulties  in  using 
models  for  new  situations  is  the  challenge  of  starting  with  a  blank  screen.  In  Chapter  4  a  novel 
approach  for  constructing  Influence  nets  quickly  is  introduced.  One  of  the  main  challenges  in 
using  TINS  has  been  the  difficulty  in  formulating  them.  Many  Subject  Matter  Experts  have  diffi¬ 
culty  in  expressing  their  knowledge  in  the  TIN  representation.  A  methodology  to  develop  do¬ 
main  specific  Timed  Influence  Nets  (TINs)  via  the  use  of  an  ontological  representation  of  do¬ 
main  data  is  presented.  The  meta-model  driven  ontology  based  approach  provides  potential  assis¬ 
tance  to  modelers  by  enabling  them  to  create  quickly  new  models  for  new  situations  through  the 
use  of  Influence  Net  Templates.  An  extension  of  Timed  Influence  nets  into  Activation  Timed 
Influence  nets  is  presented  in  Appendix  D. 

In  Chapter  5,  several  case  studies  are  presented  that  use  this  approach.  First,  a  power  law  ap¬ 
proach  for  modeling  uncertainty  is  described  and  used  for  analyzing  adversary  behavior.  Data 
collected  in  the  Diyala  province  in  Iraq  is  used.  Uncertainty  is  a  hallmark  of  conflict  behavior 
and  low-intensity  warfare,  guerrilla,  insurgency,  and  forms  of  violence  that  accompany  civil  war 
are  no  exception.  In  this  case  study,  aspects  of  the  theory  of  political  uncertainty  and  complexity 
theory  are  applied  to  the  analysis  of  conflict  events  during  the  first  three  years  of  the  second  Iraq 
war,  2003-  2006,  limited  to  the  Diyala  province.  Findings  show  that  neither  the  time  between 
attacks  T  or  the  severity  of  attacks  S  (fatalities)  have  a  normal  or  log-normal  distribution.  In¬ 
stead,  both  variables  showed  heavy  tails,  symptomatic  of  non-equilibrium  dynamics,  in  some 
cases  approximating  a  power  law  with  critical  or  near-critical  exponent  value  of  2.  The  empirical 
hazard  force  analysis  in  both  cases  showed  that  the  intensity  was  high  for  the  first  occurrences  in 
both  variables,  namely  between  March,  2003,  and  June,  2004,  but  even  higher  in  a  more  recent 
period. 
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In  the  second  case  study,  data  from  the  same  province  are  used  to  develop  Courses  of  Action 
that  would  enable  the  suppression  of  lEDs.  Two  challenges  are  addressed:  (a)  the  need  to  under¬ 
stand  how  actions  taken  by  the  military  or  other  elements  of  national  power  may  affect  the  beha¬ 
vior  of  a  society  that  includes  an  adversary  and  non  adversarial  elements,  and  (b)  the  need  to  be 
able  to  capture  and  document  data  and  knowledge  about  the  cultural  landscape  of  an  area  of  op¬ 
erations  that  can  be  used  to  support  the  understanding  of  the  key  issues,  beliefs,  and  reasoning 
concepts  of  the  local  culture  so  that  individuals  that  are  new  to  the  region  can  quickly  assimilate 
this  knowledge  and  understanding.  A  Timed  Influence  Net  was  developed  and  analyzed. 

The  third  case  study  illustrates  the  implementation  of  the  theoretical  developments  presented 
in  Chapter  3  to  show  how  it  is  now  possible  to  relax  a  number  of  limiting  assumptions  regarding 
causality  (such  as  independence  of  causes)  and  include  more  realistic  relationships  between 
causes  and  effects.  An  East  Timor  scenario  is  used  to  illustrate  the  approach. 

In  Part  III,  methodologies  for  modeling  adversary  and  coalition  organizations  are  presented. 
In  Chapter  6,  a  Petri  Net  based  organization  design  approach  is  extended  to  include  cultural  con¬ 
straints.  The  Lattice  algorithm  is  used  to  design  organizations  subject  to  a  number  of  structural 
and  user  defined  constraints.  These  constraints  are  enhanced  by  introducing  a  set  of  cultural 
constraints  based  on  Hofstede’s  dimensions.  The  approach  is  applied  to  an  example  where  both 
Blue  and  Red  organizations  are  modeled  and  the  effect  of  cultural  differences  is  highlighted.  Fi¬ 
nally,  the  approach  is  used  to  show  how  cultural  attributes  can  be  used  in  designning  effective 
coalition  organizations. 

A  key  issue  in  modeling  adversary  organizations  is  the  need  to  extract  pertinent  information 
about  the  adversary,  such  as  interactions,  activities,  beliefs,  and  resources  from  a  wide  variety  of 
unstructured  textual  data.  In  Chapter  7,  a  rapid  ethnographic  assessment  procedure  was  used  that 
moved  from  data  to  model  through  a  semi-automated  text  analysis  process.  Central  to  this 
process  is  the  AutoMap  tool.  AutoMap  is  based  on  network  text  analysis  and  so  converts  texts  to 
networks  of  relations.  Network  Text  Analysis  is  a  set  of  methodologies  for  converting  texts  to 
graphs  based  on  the  theory  that  language  and  knowledge  can  be  modeled  as  networks  of  words 
and  relations  such  that  meaning  is  inherent  in  the  structure  of  that  network.  The  semantic  net¬ 
work  is  extracted  first  and  then  the  meta-network  composed  of  agents,  resources,  expertise,  loca¬ 
tions,  activities,  beliefs  and  organizations  was  obtained. 

Understanding  an  organization’s  structure  is  critical  when  we  attempt  to  understand,  inter¬ 
vene  in,  or  manage  the  organization.  However,  organizational  structures  in  the  real  world  often 
differ  from  their  recognized  formal  structure,  and  sometimes  its  membership  conceals  the  formal 
structure  with  various  types  of  social  interactions  and  communications.  Furthermore,  when  the 
actual  social  interactions  among  the  members  of  the  group  are  observed,  the  observed  social- 
network  data  are  often  noisy,  and  contain  misleading  and  uncertain  links.  In  Chapter  8,  an  ap¬ 
proach  for  inferring  the  operational  structure  from  the  observed  structure  is  proposed.  The  ob¬ 
served  and  the  operational  structure  are  likely  to  have  distinct  profiles,  e.g.,  key  personnel  and 
clusters  of  individuals.  This  is  because  the  operational  is  focused  only  on  work  related  activities 
whereas  the  observed  one  is  a  concatenation  of  all  activities,  a  snapshot  of  human  endeavors. 
The  approach  is  illustrated  using  data  collected  on  a  real-world,  terrorist  organization. 

Social  network  simulation  (SNS)  is  an  emergent  area  of  research  that  combines  social  net¬ 
work  analysis  and  simulation,  typically  agent-based  simulation.  This  area  is  often  referred  to  as 
dynamic  network  analysis  as  much  of  the  focus  of  the  combined  modeling  approach  is  on  how 
networks  evolve,  change,  and  adapt.  Additionally  SNS  has  a  focus  on  how  individual  and  group 
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learning  and  behavior  is  impacted  by  and  impacts  the  changes  in  the  networks  in  which  the  indi¬ 
viduals  are  embedded.  Frequently,  in  social  network  simulations,  the  social  network  and  other 
networks,  such  as  the  knowledge  network,  and/or  the  individuals  or  “nodes”  in  the  network  are 
co-evolving  as  agents  interact,  learn,  and  engage  in  various  activities.  Cognitive  and  social  fac¬ 
tors  combine  to  determine  the  level  of  information  access  that  individuals/agents  may  have. 
Three  different  information  access  mechanisms:  literacy,  internet  access,  and  newspaper  reader- 
ship  were  examined.  In  Construct,  a  dynamic  network  analysis  tool,  these  access  mechanisms 
affect  whether  agents  can  interact  with  a  specific  media  and  get  information  through  a  specific 
form.  It  is  important  to  note  that  these  mechanisms  interact.  For  example,  if  an  agent  is  illiterate 
and  has  a  newspaper  subscription,  that  agent  may  read  the  news  articles  but  do  so  with  error.  On 
the  other  hand,  if  an  agent  is  literate  but  does  not  have  access  to  the  internet,  they  still  cannot 
read  web-pages  (and  the  literacy  parameter  has  no  effect).  Construct  and  its  application  to  simu¬ 
lating  the  adversary  are  described  in  Chapter  9. 

Chapter  10  contains  three  applications  of  Dynamic  Network  Modeling.  They  illustrate  that 
the  key  to  reasoning  about  the  adversary  is  taking  social  networks  and  embedding  them  within 
the  spatio-temporal  context.  Organization  theory  and  task  processing  analysis  facilitate  this  em¬ 
bedding  by  providing  the  constraints  and  enablers  on  task-related  activity. 

In  Part  III  of  this  report,  recent  research  in  multi-modeling  and  meta-modeling  is  described. 
No  single  model  can  capture  the  complexities  of  human  behavior  especially  when  interactions 
among  groups  with  diverse  social  and  cultural  attributes  are  concerned.  Each  modeling  language 
offers  unique  insights  and  makes  specific  assumptions  about  the  domain  being  modeled.  For  ex¬ 
ample,  social  networks  describe  the  interactions  (and  linkages)  among  group  members  but  say 
little  about  the  underlying  organization  and/or  command  structure.  Similarly,  organization  mod¬ 
els  focus  on  the  structure  of  the  organization  and  the  prescribed  interactions  but  say  little  on  the 
social/behavioral  aspects  of  the  members  of  the  organization.  Timed  Influence  net  models  de¬ 
scribe  cause-and-effect  relationships  among  groups  at  a  high  level.  In  order  to  address  the  model¬ 
ing  and  simulation  issues  that  arise  when  multiple  models  are  to  interoperate,  four  layers  need  to 
be  addressed.  The  first  layer,  Physical,  i.e..  Hardware  and  Software,  is  a  platform  that  enables  the 
concurrent  execution  of  multiple  models  expressed  in  different  modeling  languages  and  provides 
the  ability  to  exchange  data  and  also  to  schedule  the  events  across  the  different  models.  The 
second  layer  is  the  syntactic  layer  which  ascertains  that  the  right  data  are  exchanged  among  the 
models.  The  Physical  and  Syntactic  layers  have  been  addressed  through  the  development  of  two 
testbeds:  C2  Wind  Tunnel  (C2WT)  by  Vanderbilt  University  in  collaboration  with  UC-Berkeley 
and  George  Mason  University  (Appendix  E)  and  SORASCS  developed  by  CASOS  at  Carnegie 
Mellon  University.  Both  have  been  used  and  developed  further  in  this  project. 

Once  the  testbeds  became  available,  a  third  problem  needed  to  be  addressed  at  the  Semantic 
layer,  where  the  interoperation  of  different  models  is  examined  to  ensure  that  conflicting  as¬ 
sumption  in  different  modeling  languages  are  recognized  and  form  constraints  to  the  exchange  of 
data.  In  the  fourth  layer,  the  Workflow  layer,  valid  combinations  of  interoperating  models  are 
considered  to  address  specific  applications.  Different  applications  require  different  workflows. 
The  use  of  multiple  interoperating  models  is  referred  to  as  multi-modeling  while  the  analysis  of 
the  validity  of  model  interoperation  is  referred  to  as  meta-modeling.  Such  an  approach  has  been 
used  in  simulation  mode  or  to  explore  the  possible  outcomes  of  proposed  courses  of  action;  it  has 
not  been  used  to  predict  outcomes. 
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In  Chapter  1 1,  the  focus  is  on  issues  relating  to  the  syntactic  and  semantic  layers.  In  Chapter 
12,  an  ontology  based  approach  is  used  to  analyze  (deconstruct)  modeling  languages  and  identify 
common  concepts,  unique  concepts,  and  contradictory  concepts.  An  enriched  ontology  is  ob¬ 
tained  that  then  guides  the  interoperation  of  models  by  shedding  light  on  which  questions  can  be 
answered  via  a  valid  interoperation  of  two  models  and  which  questions  would  trigger  the  use  of 
contradictory  concepts.  This  type  of  result  is  key  to  developing  valid  workflows  for  using  mul¬ 
tiple  models  in  addressing  adversary  modeling  and  complex  policy  issues.  This  work  was  not 
included  in  the  original  scope  of  work;  it  became  apparent  in  the  third  year  of  the  research  effort 
that  the  simulation  technology  had  reached  a  stage  where  multi-modeling  became  practical. 

In  Part  IV,  most  of  the  research  results  were  integrated  by  conducting  a  complex  computa¬ 
tional  experiment.  The  issue  addressed  was  deterrence  -  specifically  determining  Courses  of  Ac¬ 
tion  for  the  US  in  encouraging  de-escalation  of  an  evolving  crisis  between  two  states  that  have 
strong  ties  to  the  US.  In  Chapter  13,  the  concept  of  deterrence,  as  it  is  evolving  beyond  nuclear 
deterrence  between  two  peer  states,  is  discussed  with  emphasis  on  cyber  deterrence  policy  and 
strategy.  Then  in  Chapter  14,  a  detailed  case  study  based  on  an  India-Pakistan  crisis  scenario  is 
described.  Multi-modeling  was  used  extensively  to  represent  India,  Pakistan,  the  US  central 
Command,  and  the  US  Pacific  Command.  Other  state  actors  were  also  included.  The  results,  pre¬ 
sented  in  a  day-long  workshop,  showed  that  the  approaches  taken  to  adversary  modeling  have 
promise  and  are  implementable. 
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Chapter  2 


Course  of  Action  Analysis  in  a  Cultural  Landscape  Using  Influence  Nets 

Lee  W.  Wagenhals  and  Alexander  H.  Levis 


2.1  Introduction 

In  this  chapter,  two  challenges  are  addressed:  (a)  the  need  to  understand  how  actions  taken  by  the 
military  or  other  elements  of  national  power  may  affect  the  behavior  of  a  society  that  ineludes  an 
adversary  and  non  adversarial  elements,  and  (b)  the  need  to  be  able  to  capture  and  doeument  da¬ 
ta  and  knowledge  about  the  cultural  landscape  of  an  area  of  operations  that  can  be  used  to  sup¬ 
port  the  understanding  of  the  key  issues,  beliefs,  and  reasoning  coneepts  of  the  loeal  culture  so 
that  individuals  that  are  new  to  the  region  can  quickly  assimilate  this  knowledge  and  understand¬ 
ing. 

The  first  challenge  relates  to  eapabilities  that  enable  the  analysis  needed  to  conduet  focused 
effeets  based  planning  and  effects  based  operations.  Models  to  support  Effeets  Based  Operations 
developed  to  date  relate  aetions  to  effects  on  the  adversary  [1],  Such  models  can  be  quite  effec¬ 
tive  in  informing  the  eomparison  of  alternative  courses  of  action  provided  the  relationships  be¬ 
tween  potential  aetions  and  the  effects  are  well  understood.  This  depends  on  the  ability  to  model 
an  adversary’s  intent  and  his  reactions  and  identifying  his  vulnerable  points  of  influenee.  But  as 
the  nature  of  Blue’s  military  operations  goes  well  beyond  the  traditional  major  combat  opera¬ 
tions,  there  is  the  need  to  antieipate  the  effeets  of  actions  not  only  on  the  adversary  (Red),  but 
also  on  the  local  population  which  may  support  or  oppose  that  adversary.  Such  support  may  de¬ 
pend  in  part  on  the  aetions  taken  by  Blue. 

The  seeond  ehallenge  involves  the  need  for  new  personnel  to  rapidly  assimilate  the  loeal 
knowledge  needed  to  analyze  the  local  situation  and  to  analyze  and  formulate  the  effects  based 
plans  and  operations.  Data  about  a  eulture  exists  in  many  forms  and  from  many  sourees  includ¬ 
ing  historical  reference  doeuments,  observations  and  reports  by  intelligence  analysts,  and  unelas- 
sified  (and  unverified)  sourees  such  as  the  internet.  The  data  is  often  incomplete  and  partially 
ineorreet  and  includes  contradictions  and  inconsistencies.  Analysts,  partieularly  those  new  to  an 
area  of  operation  who  are  responsible  for  formulating  eourses  of  aetion,  are  hard  pressed  to 
quiekly  develop  the  neeessary  understanding  of  the  cultural  factors  that  will  affect  the  behavior 
of  the  adversary  and  the  soeiety  in  whieh  it  is  embedded. 

2.2  Timed  Influence  Nets 

Several  modeling  teehniques  are  used  to  relate  aetions  to  effeets.  With  respect  to  effects  on 
physical  systems,  engineering  or  physies  based  models  have  been  developed  that  ean  predict  the 
impaet  of  various  aetions  on  systems  and  assess  their  vulnerabilities.  When  it  comes  to  the  cog¬ 
nitive  belief  and  reasoning  domain,  engineering  models  are  mueh  less  appropriate.  The  purpose 
of  affecting  the  physical  systems  is  to  eonvinee  the  leadership  of  an  adversary  to  ehange  its  be¬ 
havior,  that  is,  to  make  decisions  that  it  would  not  otherwise  make.  However,  when  an  adversary 
in  imbedded  within  a  culture  and  depends  upon  elements  of  that  eulture  for  support,  the  effeets 
of  physieal  actions  may  influence  not  only  the  adversary,  but  the  individuals  and  organizations 
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within  the  culture  that  can  choose  to  support,  be  neutral,  or  oppose  the  adversary.  Thus,  the  ef¬ 
fects  on  the  physical  systems  influence  the  beliefs  and  the  decision  making  of  the  adversary  and 
the  cultural  environment  in  which  the  adversary  operates.  Because  of  the  subjective  nature  of 
belief  and  reasoning,  probabilistic  modeling  techniques  such  as  Bayesian  Nets  and  their  influ¬ 
ence  net  cousin  have  been  applied  to  these  types  of  problems.  Models  created  using  these  tech¬ 
niques  can  relate  actions  to  effects  through  probabilistic  cause  and  effect  relationships.  Such 
probabilistic  modeling  techniques  can  be  used  to  analyze  how  the  actions  affect  the  beliefs  and 
thus  the  support  to  and  decisions  by  the  adversary. 

Influence  Nets  (IN)  and  their  Timed  Influence  Nets  (TIN)  extension  are  abstractions  of  Prob¬ 
abilistic  Belief  Nets  also  called  Bayesian  Networks  (BN)  [2,  3],  the  popular  tool  among  the  Ar¬ 
tificial  Intelligence  community  for  modeling  uncertainty.  BNs  and  TINs  use  a  graph  theoretic 
representation  that  shows  the  relationships  between  random  variables.  These  random  variables 
can  represent  various  elements  of  a  situation  that  can  be  described  in  a  declarative  statement, 
e.g.,  X  happened,  Y  likes  Z,  etc. 

Influence  Nets  are  Directed  Acyclic  Graphs  where  nodes  in  the  graph  represent  random  va¬ 
riables,  while  the  edges  between  pairs  of  variables  represent  causal  relationships.  While  mathe¬ 
matically  Influence  Nets  are  similar  to  Bayesian  Networks,  there  are  some  key  differences.  BNs 
suffer  from  the  often  intractable  task  of  knowledge  elicitation  of  conditional  probabilities.  To 
overcome  this  limitation,  INs  use  CAST  Logic  [4,  5],  a  variant  of  Noisy-OR  [6,  7],  as  a  know¬ 
ledge  acquisition  interface  for  eliciting  conditional  probability  tables. 

The  modeling  of  the  causal  relationships  in  TINs  is  accomplished  by  creating  a  series  of 
cause  and  effect  relationships  between  some  desired  effects  and  the  set  of  actions  that  might  im¬ 
pact  their  occurrence  in  the  form  of  an  acyclic  graph.  The  actionable  events  in  a  TIN  are  drawn 
as  root  nodes  (nodes  without  incoming  edges).  Generally,  desired  effects,  or  objectives  the  deci¬ 
sion  maker  is  interested  in,  are  modeled  as  leaf  nodes  (nodes  without  outgoing  edges).  In  some 
cases,  internal  nodes  are  also  effects  of  interest.  Typically,  the  root  nodes  are  drawn  as  rectan¬ 
gles  while  the  non-root  nodes  are  drawn  as  rounded  rectangles.  Figure  2.1  shows  a  partially  spe¬ 
cified  TIN.  Nodes  B  and  E  represent  the  actionable  events  (root  nodes)  while  node  C  represents 
the  objective  node  (leaf  node).  The  directed  edge  with  an  arrowhead  between  two  nodes  shows 
the  parent  node  promoting  the  chances  of  a  child  node  being  true,  while  the  roundhead  edge 
shows  the  parent  node  inhibiting  the  chances  of  a  child  node  being  true.  The  inscription  asso¬ 
ciated  with  each  arc  shows  the  corresponding  time  delay  it  takes  for  a  parent  node  to  influence  a 
child  node.  For  instance,  event  B,  in  Fig.  2.1,  influences  the  occurrence  of  event  A  after  5  time 
units. 


Fig.  2.1  An  Example  Timed  Influence  Net  (TIN) 


II 


Formally,  a  TIN  is  described  by  the  following  definition. 


Definition  2.1:  Timed  Influence  Net  (TIN) 

A  TIN  is  a  tuple  (V,  E,  C,  B,  De,  Dy,  A)  where 
V:  set  of  Nodes, 

E:  set  of  Edges, 

C  represents  causal  strengths: 

E  { (h,  g)  such  that  -1  <  h,  g  <  1  }, 

B  represents  Baseline  /  Prior  probability:  V  ->  [0,1], 

De  represents  Delays  on  Edges:  E  -> 

(where  represent  the  set  of  positive  integers), 

Dy  represents  Delays  on  Nodes:  V  Z^,  and 

A  (input  scenario)  represents  the  probabilities  associated  with  the  state  of  actions  and  the  time 
associated  with  them. 

A:  R  ^  {([pi,  P2,...,  Pn],[[tll,ti2],  [t21,t22],  •  •  ■•,[tnl,tn2]]  ) 

such  that  Pi  =  [0,  1],  ty  Z  and  fi  <  ti2, 

V  i  =  1,  2,  ....,  n  andj  =  1,2  where  R  e  V  } 

(where  Z*  represent  the  set  of  nonzero  positive  integers) 


The  purpose  of  building  a  TIN  is  to  evaluate  and  compare  the  performance  of  alternative 
courses  of  actions.  The  impact  of  a  selected  course  of  action  on  the  desired  effects  is  analyzed 
with  the  help  of  a  probability  profile.  Consider  the  TIN  shown  in  Fig.  2.1.  Suppose  the  following 
input  scenario  is  decided:  actions  B  and  E  are  taken  at  times  1  and  7,  respectively.  Because  of  the 
propagation  delay  associated  with  each  arc,  the  influences  of  these  actions  impact  event  C  over  a 
period  of  time.  As  a  result,  the  probability  of  C  changes  at  different  time  instants.  A  probability 
profile  draws  these  probabilities  against  the  corresponding  time  line.  The  probability  profile  of 
event  C  is  shown  in  Fig.  2.2. 

To  construct  and  use  a  TIN  to  support  effects  based  operations,  the  following  process  has 
been  defined. 

1 .  Determine  the  set  of  desired  and  undesired  effects  expressing  each  as  declarative  statement 
that  can  be  either  true  or  false.  For  each  effect,  define  one  or  more  observable  indicators 
that  the  effect  has  or  has  not  occurred. 

2.  Build  an  IN  that  links,  through  cause  and  effect  relationships,  potential  actions  to  the  de¬ 
sired  and  undesired  effects. 
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Time 

Fig  2.2  Probability  Profile  for  Node  C 


Note  that  this  may  require  defining  additional  intermediate  effects  and  their  indicators. 

3.  Use  the  IN  to  compare  different  sets  of  actions  in  terms  of  the  probability  of  achieving  the 
desired  effects  and  not  causing  the  undesired  effects. 

4.  Transform  the  IN  to  a  TIN  by  incorporating  temporal  information  about  the  time  the  poten¬ 
tial  actions  will  occur  and  the  delays  associated  with  each  of  the  arcs  and  nodes. 

5.  Use  the  TIN  to  experiment  with  different  timings  for  the  actions  to  identify  the  “best”  COA 
based  on  the  probability  profiles  that  each  candidate  generates.  Determine  the  time  win¬ 
dows  when  observation  assets  may  be  able  to  observe  key  indicators  so  that  assessment  of 
progress  can  be  made  during  COA  execution. 

6.  Create  a  detailed  execution  plan  to  use  the  resources  needed  to  carry  out  the  COA  and  col¬ 
lect  the  information  on  the  indicators. 

7.  Use  the  indicator  data  to  assess  progress  toward  achieving  the  desired  effects. 

8.  Repeat  steps  2  (or  in  some  cases  1)  through  7  as  new  understanding  of  the  situation  is  ob¬ 
tained. 

In  building  the  IN,  the  modeler  must  assign  values  to  the  pair  of  parameters  that  show  the 
causal  strength  (usually  denoted  as  g  and  h  values)  for  each  directed  link  that  connects  pairs  of 
nodes,.  Each  non-root  node  has  an  associated  baseline  probability  that  must  be  assigned  by  the 
modeler  (or  left  at  the  default  value  of  0.5).  It  represents  the  probability  that  the  random  variable 
will  be  true  in  the  absence  of  all  modeled  influences  or  causes.  Each  root  node  is  given  a  prior 
probability,  which  is  the  initial  probability  that  the  random  variable  associated  with  the  node 
(usually  a  potential  action)  is  true. 

When  the  modeler  converts  the  IN  into  a  TIN  (step  4),  each  link  is  assigned  a  corresponding 
delay  d  (where  d  >  0)  that  represents  the  communication  delay.  Each  node  has  a  corresponding 
delay  e  (where  e  >  0)  that  represents  the  information  processing  delay.  A  pair  (p,  t)  is  assigned  to 
each  root  node,  where  p  is  a  list  of  real  numbers  representing  probability  values.  For  each  proba¬ 
bility  value,  a  corresponding  time  interval  is  defined  in  t.  In  general,  (p,  t)  is  defined  as 

([Ph  P2,  -,  Pn],  [[til,  tl2],  [t21,  t22],  •••■,  [Ul,  W]]  ), 
where  tn  <  ti2  and  >  0  V  i  =  1,  2,  . . ..,  n  and  j  =  1,2 
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The  last  item  is  referred  to  as  an  input  scenario,  or  sometimes  (informally)  as  course  of  ac¬ 
tion. 

To  analyze  the  TIN  (Step  5),  the  analyst  selects  the  nodes  that  represent  the  effects  of  interest 
and  generates  probability  profiles  for  these  nodes.  The  probability  profiles  for  different  courses 
of  action  can  then  be  compared. 
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Chapter  3 


Theory  of  Influence  Networks 

Abbas  K.  Zaidi,  Faisal  Mansoor,  P.  Papantonl-Kazakos,  Alexander  H.  Levis 


3.1  Introduction 

The  easy  access  to  domain-specific  information  and  cost-effective  availability  of  high  com¬ 
putational  power  have  changed  the  way  people  think  about  complex  decision  problems  in 
almost  all  areas  of  application,  ranging  from  financial  markets  to  regional  and  global  politics. 
These  decision  problems  often  require  modeling  of  informal,  uncertain  and  unstructured  do¬ 
mains,  to  allow  the  evaluation  of  alternatives  and  available  courses  of  actions  by  a  decision 
maker.  The  past  decade  has  witnessed  an  emergence  of  several  modeling  and  analysis  for¬ 
malisms  that  target  this  need,  the  most  popular  one  being  represented  by  Probabilistic  Belief 
Networks  [3,  8],  most  commonly  known  as  Bayesian  Networks  (BNs). 

BNs  model  uncertain  domains  probabilistically,  by  presenting  the  network  nodes  as  ran¬ 
dom  variables.  The  arcs  (or  directed  edges)  in  the  network  represent  the  direct  dependency 
relationships  between  the  random  variables.  The  arrows  on  the  edges  depict  the  direction  of 
the  dependencies.  The  strengths  of  these  dependencies  are  captured  as  conditional  probabili¬ 
ties  associated  with  the  connected  nodes  in  a  network.  A  complete  BN  model  requires  speci¬ 
fication  of  all  conditional  probabilities  prior  to  its  use.  The  number  of  conditional  probabili¬ 
ties  on  a  node  in  a  BN  grows  exponentially  with  the  number  of  inputs  to  the  node,  which 
presents  a  computational  challenge,  at  times.  A  major  problem  in  BNs  is  the  specification  of 
the  required  conditional  probabilities,  especially  when  either  objective  values  of  these  proba¬ 
bilities  cannot  be  provided  by  experts  or  there  exist  insufficient  empirical  data  to  allow  for 
their  reliable  estimation,  or  when  newly  obtain  information  may  change  the  structural  topol¬ 
ogy  of  the  network.  Although  a  pair-wise  cause  and  effect  relationship  between  two  va¬ 
riables  of  a  domain  is  easier  to  establish  or  extract  from  a  domain  expert,  a  BN  of  the  domain 
requires  prior  knowledge  of  all  the  influencing  causes  to  an  effect  as  well  as  their  aggregate 
influence  on  the  effect  variable,  where  the  measures  of  influences  are  conditional  probability 
values.  To  demonstrate  cases  where  BN  modeling  may  be  problematic,  we  identify  the  fol¬ 
lowing  situations  of  practical  significance:  (1)  When  new,  previously  unknown,  affecting  va¬ 
riables  to  some  effect  event  arise,  there  are  no  algorithms  allowing  easy  pertinent  adaptation 
of  conditional  probabilities.  (2)  When  the  need  arises  to  develop  a  consolidated  BN  from 
partial  fragments  of  separate  BNs,  there  are  no  algorithms  that  utilize  the  parameters  of  the 
fragments  to  calculate  the  parameters  of  the  consolidated  structure. 

Recognizing  the  problems  in  the  construction  of  BNs,  especially  regarding  the  specifica¬ 
tion  of  the  involved  conditional  probabilities,  Chang  et  al.  [4]  developed  a  formalism  at 
George  Mason  University  named  Causal  Strength  (CAST)  logic,  as  an  intuitive  and  approx¬ 
imate  language.  The  logic  utilizes  a  pair  of  parameter  values  to  represent  conditional  depen¬ 
dency  between  a  pair  of  random  variables,  where  these  parameter  values  model  assessed  (by 
experts)  mutual  influences  between  an  affecting  and  an  affected  event.  The  CAST  logic  ap¬ 
proximates  conditional  probabilities  via  influence  relationships  by  employing  an  influence 
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aggregation  function.  The  approach  provides  the  elicitation,  update,  reuse,  and  merge  inter¬ 
face  to  an  underlying  BN,  or  multiple  fragments  of  a  BN,  that  only  requires  specification  of 
individual  influences  between  each  pair  of  an  affecting  and  an  affected  variables.  The  ap¬ 
proach  then  combines  these  individual  influences  to  calculate  the  aggregate  effect  of  multiple 
affecting  variables  on  an  effect  variable  in  terms  of  conditional  probability  values  of  a  result¬ 
ing  BN.  This  pair-wise  specification  of  influences  provides  us  with  the,  albeit  approximate, 
means  to  solve  the  three  problems  discussed  earlier. 

The  CAST  logic  approach  was  later  extended  to  represent  relationships  between  events 
involved  in  network  interconnections,  as  in  BNs.  The  extension  is  basically  a  BN  with  con¬ 
ditional  probabilities  approximated  via  the  use  of  influence  parameters  and  was  named  Influ¬ 
ence  Nets  (INs)  [5,  9,  10,  11].  INs  require  an  expert  who  specifies  the  influence  parameter 
values  and  their  interrelationships,  as  well  as  some  a  priori  probabilities,  all  needed  for  the 
approximation  of  the  pertinent  conditional  probabilities.  As  basically  modified  BNs,  the  ob¬ 
jective  of  INs  is  to  compute  the  probabilities  of  occurrence  of  sequential  dependent  events, 
and  do  not  provide  recommendations  for  actions.  However,  the  probabilities  of  occurrence 
computed  by  the  INs  may  be  utilized  by  activation  networks  towards  the  evaluation  and  rec¬ 
ommendation  of  actions  [12]. 

BNs  and  INs  are  designed  to  capture  static  interdependencies  among  variables  in  a  sys¬ 
tem.  A  situation  where  the  impact  of  a  variable  takes  some  time  to  reach  the  affected  varia- 
ble(s)  cannot  be  modeled  by  either  one.  In  the  last  several  years,  efforts  have  been  made  to 
integrate  the  notion  of  time  and  uncertainty.  Wagenhals  et  al.  [12,  13,  14]  have  added  a  spe¬ 
cial  set  of  temporal  constructs  to  the  basic  formalism  of  INs.  The  INs  with  these  additional 
temporal  constructs  are  called  Timed  Influence  Nets  (TINs).  TINs  have  been  experimentally 
used  in  the  area  of  Effects  Based  Operations  (EBOs)  for  evaluating  alternate  courses  of  ac¬ 
tions  and  their  effectiveness  to  mission  objectives  in  a  variety  of  domains,  e.g.,  war  games 
[1,  15,  16,  17],  and  coalition  peace  operations  [18],  modeling  adversarial  behaviors  [35],  to 
name  a  few.  The  provision  of  time  allows  for  the  construction  of  alternate  courses  of  action 
as  timed  sequences  of  actions  or  actionable  events  represented  by  nodes  in  a  TIN  [13,  15, 
17].  A  number  of  analysis  tools  have  been  developed  over  the  years  for  TIN  models,  to  help 
an  analyst  update  beliefs  [19,  20,  21,  22,  23]  represented  as  nodes  in  a  TIN,  to  map  a  TIN 
model  to  a  Time  Sliced  Bayesian  Network  for  incorporating  feedback  evidence,  to  determine 
best  course  of  actions  for  both  timed  and  un-timed  versions  of  Influence  Nets  [24,  25]  and  to 
assess  temporal  aspects  of  the  influences  on  objective  nodes  [26,  27]. 

The  existing  developments  of  INs  and  TINs  suffer  from  a  number  of  deficiencies:  they 
do  not  represent  scenarios  encompassing  dependent  conditioning  events  and  they  utilize  a 
priori  probabilities  inconsistently,  in  violation  of  the  Bayes  Rule  and  the  Theory  of  Total 
Probability.  The  motivation  behind  the  work  presented  in  this  paper  is  to  address  these 
shortcomings  of  INs  and  TINs  by  developing  a  correct  analytical  framework  for  the  design 
and  analysis  of  influences  on  some  critical  effects  due  to  a  set  of  external  affecting  events. 
We  present  a  comprehensive  theory  of  Influence  Networks,  which  is  free  of  restrictive  inde¬ 
pendence  assumptions,  which  is  consistently  observing  the  Bayes  Rule  and  the  Theorem  of 
Total  Probability.  In  this  theory,  we  are  concerned  with  the  evaluation  of  cause-effect  rela¬ 
tionships  between  interconnected  events.  In  particular,  if  the  status  of  some  event  B  is  af¬ 
fected  by  the  status  of  a  set  of  events,  Ai  to  An,  we  are  interested  in  a  qualification  and  quan¬ 
tification  of  this  effect.  We  first  graph  the  relationships  between  events  B  and  Ai  to  An  in  a 
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network  format,  as  in  Fig.  3.1  below,  with  each  event  being  a  node,  with  arcs  indicating  rela¬ 
tionships  and  with  arrows  representing  the  cause-effect  directions.  This  graphical  represen¬ 
tation  is  identical  to  that  used  in  BNs. 


Fig.  3.1  Cause-Effect  Relationships 

Given  the  graph  of  Fig.  3.1,  we  next  decide  the  metric  to  be  used  for  the  quantification  of 
the  effects  of  events  Ai  to  An  on  event  B.  As  in  BNs,  modeling  each  of  the  involved  events 
as  binary  random  variables,  we  use  conditional  probabilities  as  effect  metrics:  in  particular, 
we  use  the  probabilities  that  event  B  occurs,  given  each  of  the  2"  scenarios  regarding  the  oc¬ 
currence  or  nonoccurrence  of  each  one  of  the  events  Ai  to  An. 

Upon  the  decision  to  use  conditional  probabilities  as  the  effect  metrics,  the  issue  of  their 
computation  arises.  In  most  realistic  scenarios,  there  exist  insufficient  amount  of  data  for  the 
reliable  estimation  of  these  probabilities.  Instead,  some  influence  indicators  may  be  provided  by 
experts.  In  the  example  of  Fig.  3.1,  for  instance,  for  each  one  of  the  2"  scenarios  regarding  the 
occurrence  or  nonoccurrence  of  each  on  of  the  events  Ai  to  An,  an  expert  may  provide  a  number 
between  -1  and  1,  to  reflect  his  assessment  as  to  the  effect  of  the  above  scenario  on  the  occur¬ 
rence  of  event  B.  The  latter  number  is  named  influence  constant.  The  objective  at  this  point  is 
to  utilize  the  so  provided  influence  constants  for  the  approximate  evaluation  and  computation  of 
the  required  conditional  probabilities,  in  a  mathematically  correct  and  consistent  fashion.  These 
conditional  probabilities  are  subsequently  utilized  for  the  probabilistic  evaluation  of  event  occur¬ 
rences  in  a  network  of  events,  giving  rise  to  an  Influence  Network  (IN).  In  different  terms,  a  IN 
is  a  BN  whose  conditional  probabilities  are  computed  via  the  use  of  influence  constants.  The 
term  IN  should  not  be  confused  with  a  similarly  named  formalism  called  Influence  Diagrams 
[28,  29,  30,  31].  Unlike  INs,  an  Influence  Diagram  (ID)  has  different  types  of  nodes  (i.e.,  deci¬ 
sion  nodes,  chance  nodes,  and  utility  nodes)  and  different  types  of  influences  (i.e.,  arcs  between 
the  nodes);  and  the  decisions  in  an  ID  are  assumed  to  have  a  certain  precedence  relationship 
among  them.  The  IDs  can  be  considered  a  BN  extended  with  a  utility  function,  while  a  IN,  as 
noted  above,  is  a  special  instance  of  a  BN  whose  conditional  probabilities  are  computed  via  the 
use  of  influence  constants  and  which  uses  a  set  of  special  purpose  algorithms  for  calculating  the 
impact  of  a  set  of  external  affecting  events  on  some  desired  effect/objective  node. 

Frequently,  in  several  realistic  scenarios,  assessments  of  event  occurrences  may  be 
needed  at  times  when  the  status  of  all  affecting  events  may  not  be  known,  while  such  as¬ 
sessments  require  sequential  adaptation,  as  the  status  of  more  affecting  events  are  revealed. 
For  example,  in  Fig.  1,  the  evaluation  of  the  probability  of  event  B  may  be  needed  at  times 
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when  the  status  of  only  some  of  the  events  A  are  known,  while  this  probability  need  to  be 
subsequently  adapted  when  the  status  of  the  remaining  A  events  become  known.  Such  se¬ 
quential  adaptations  require  pertinent  sequential  computation  methodologies  for  the  approx¬ 
imation  of  conditional  probabilities  via  influence  constants  and  give  rise  to  Time  Influence 
Networks  (TINs).  We  present  two  different  temporal  models  for  the  sequential  computation 
of  conditional  probabilities  in  a  Timed  Influence  Nets.  This  enhances  the  capabilities  of  the 
Timed  Influence  Nets  in  modeling  domains  of  interest  with  different  time  characteristics. 

The  organization  of  the  paper  is  as  follows:  In  section  3.2,  we  present  the  theoretical  for¬ 
malization  and  derive  initial  relationships.  In  section  3.3,  we  derive  the  dynamic  program¬ 
ming  evolution  of  the  influence  constants.  In  section  3.4,  we  examine  the  case  where  in  the 
generic  model,  the  affecting  events  are  mutually  independent,  where  in  section  3.5,  the  case 
where  the  latter  events  form  a  Markov  chain  is  examined.  In  section  3.6,  temporal  considera¬ 
tions  are  presented.  In  section  3.7  we  discuss  decision  model  selection  and  testing.  In  section 
3.8,  special  forms  of  the  influence  constants  are  discussed.  In  Section  3.9,  we  discuss  evalua¬ 
tion  metrics.  In  section  3.10,  the  experimental  setup  is  laid  out,  while  in  the  final  section, 
3.11,  conclusions  are  drawn. 

3.2  Initial  Modeling  and  Relationships 

In  this  section,  we  formalize  our  approach  for  the  development  of  INs  and  TINs. 

Let  us  consider  an  event  B  being  potentially  affected  by  events  }i  <<<« .  In  particular, 
we  are  interested  in  the  effect  the  presence  or  absence  of  any  of  the  events  in  the  set 
{4}i  may  have  on  the  occurrence  of  event  B. 

Let  us  first  define: 

X" :  An  n-dimensional  binary  random  vector  whose  component  is  denoted  Xj , 
where  Xj  =  1 ;  if  the  event  Aj  is  present,  and  X j  =  Q-,  if  the  event  Aj  is  absent. 

We  will  denote  by  x”  realizations  or  values  of  the  random  vector  A" .  A  given  realization  x"  of 
the  binary  vector  X”  describes  precisely  the  status  of  the  set  {A^}i  <i<n  of  events,  regarding 
which  events  in  the  set  are  present.  We  name  the  vector  X" ,  the  status  vector  of  the  affecting 
events.  To  quantify  the  effects  of  the  status  vector  X"  on  the  event  B,  we  define  the  influence 
constant  /i„(x”)  via  the  following  quantitative  properties: 


Km  = 


1  ;if 
-1  ;if 
0  ;if 


given  n  affecting  events,  given  the  status 

fi 

vector  ,  event  B  occurs  surely 
given  n  affecting  events,  given  the  status 
vector  ,  the  nonoccurrence  of  event  B  is  sure 
given  n  affecting  events,  given  the  status 
vector  ,  the  occurrence  of  event  B  is  unaffected 


(3.1) 
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Let  p[b  l<)  denote  the  probability  of  occurrence  of  event  B,  given  the  status  vector  x". 
Then,  the  quantitative  definition  of  the  influence  constant  in  (3.1)  can  be  rewritten  as 

follows,  where  P{b)  denotes  the  unconditional  probability  of  occurrence  of  the  event  B. 


P(5|<)  = 


1  ;  if 
p{b)-  if 

0  ;  if 


=  0 


(3.2) 


We  now  extend  the  definition  of  all  values  in  [1,-1]  of  the  influence  constant,  via  linear  in¬ 
terpolation  from  (3.2).  In  particular,  we  define  the  influence  constant  via  its  use  to  determine 
the  derivation  of  the  conditional  probability  p{b\x"^  from  the  unconditional  probabilities 
P{b\  where  this  derivation  is  derived  via  linear  interpolation  from  (3.2).  We  thus  obtain. 


p{b  x'’)=  ^ ^ 

^  I  P{B)  +  h„{x:)P{B)  ;if/i„(x;)e[-l,0] 


(3.3) 


Defining 


J 1 ;  if  y  >  0 
[0;if  y  <  o’ 


we  can  finally  write  (3.3)  as  follows 


p[b  I  Xi" )  =  P(5){1  +  h„ (xi" )[1  - P(5)]P-' >  x{\  +  h„ (xi" (3.4) 


At  this  point,  we  present  a  formal  definition  of  INs  and  TINs. 

Definition  3.1:  An  Influence  Network  (IN)  is  a  Bayesian  Network  mapping  conditional 
probabilities  p{b  \  x” )  via  the  utilization  of  influence  constants  as  in  (3.4).  Formally,  an  In¬ 
fluence  Net  is  a  tuple  (V,  E,  C,  A,  B),  with  G  =  (V,  E)  representing  a  directed-acyclic  graph 
satisfying  the  Markov  condition  (as  in  BN),  where: 

V:  set  of  nodes  representing  binary  random  variables, 

E:  set  of  edges  representing  causal  influences  between  nodes, 

C:  set  of  causal  strengths:  E  ='\),h!{'\x^  =  O)]  such  that /zj'sg  [-l,l] }, 

A:  a  subset  of  V  representing  external  affecting  events  {A^}\  <i<n  and  a  status  of  the  corre- 
ponding  vector  A” , 

B:  Probability  distribution  of  the  status  vector  A"  corresponding  to  the  external  affecting 
events  {A^}\  <i<n. 


A  Timed  Influence  Network  (TIN)  adds  two  temporal  parameters  to  the  definition  of  a  IN. 
Formally,  a  TIN  is  a  tuple  (V,  E,  C,  D,  At,  B),  where  V,  E,  C,  and  B  are  as  defined  for  INs; 
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D:  set  of  temporal  delays  on  edges:  E  — N, 

At:  same  as  A  with  the  addition  that  the  status  of  each  external  affecting  event  is  time  tagged 
representing  the  time  of  realization  of  its  status.  In  the  IN/TIN  literature  [12,  13,  15,  16, 
17,  18,  25],  At  is  also  referred  to  as  a  Course  of  Action  (CO A).  A  COA  is,  therefore,  a 
time-sequenced  collection  of  external  affecting  events  and  their  status. 

Returning  to  the  influence  constant  notion,  we  note  that  there  exist  2”  distinct  values  of 
the  status  vectors";  thus,  there  exist  2" distinct  values  of  the  influence  constant  /2„(x")as 
well  as  of  the  conditional  probabilities  in  (3.4).  In  the  case  where  the  cardinality  of  the  set 
{A^}\<i<n  is  one,  the  influence  constant  /Zj(xj) equals  the  constant  h  in  [5];  if  Xj=land 

equals  the  constant  gin  [5];  ifxj  =0. 

We  now  proceed  with  a  definition  which  will  lead  to  a  mathematically  correct  relationship 
between  influence  constants  and  unconditional  probabilities. 

Definition  3.2:  A  IN  or  TIN  model  is  consistent  if  it  observes  the  Bayes  Rule. 

Let  P{x")  denote  the  probability  of  the  status  vector  X”  at  the  value  x” .  We  can  then  express 
the  following  simple  lemma. 

Lemma  3.1 

Let  the  influence  constant  /2„(x")be  accepted  as  reflecting  accurately  the  relationship  be¬ 
tween  the  affecting  events  {Af}i<i<n  and  event  B.  Then  the  IN  or  TIN  model  is  consistent 
iff: 


){1  +  K  K  )[1  -  P(BP-'  (i)}-*-''’’  {i  +  K  =  1 


(3J) 


or 


s/>LK«)ii-w)K'(sr*-"'’=o 


Proof:  Substituting  expression  (3.4)  in  the  the  Bayes’  Rule,  P{b)  =  y'P{x")P{B  \  x”),  we  ob- 

g 

tain  (3.5). 

Expression  (3.5)  relates  the  influence  constant  /i„(x")to  the  unconditional  probabilities  of 
event  B  and  the  status  vector  X" .  This  relationship  is  necessary  if  the  influence  constant  is 
accepted  as  accurately  representing  the  conditional  probability  P{B\x”)  in  (3.3).  Generally, 
the  influence  constant  is  selected  based  on  a  system  design  assessment  provided  by  experts, 
while  the  a  priori  probabilities  T’(x")  are  accepted  to  accurately  represent  the  actual  model. 
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Summary 


Given  the  events  in  Fig.  3.1,  given  well-established  a  priori  probabilities  of  the  cause 
events,  given  the  influence  constants,  the  cause-effect  conditional  probabilities  are  ex¬ 
pressed  as  follows: 


p{b  x” )=  I"  ^  ^  ^ 

''  I  a  +  Kix':)a  ;if/!,(x;)e[-l,0] 


where 


a  =  P{B)  = 


xf  :sgn  (xf  )=1 


x" 


Influence  nets  thus  utilize  expert-provided  subjective  influence  constants,  in  conjunction  with 
well-established  objective  a  priori  probabilities  of  cause  events,  to  generate  conditional 
probabilities  of  effect  events. 

3.3  Evolution  of  the  influence  Constant 


In  section  3.2,  we  derived  the  relationship  between  the  conditional  probability  of  event  B, 
and  the  status  x"  of  its  affecting  events  {f}\  <i<n,  via  the  influence  constant /2„(x") .  This  rela¬ 
tionship  is  based  on  the  assumption  that  {Af\<i<n  is  the  maximum  set  of  events  affecting 

event  B  and  that  the  value  x"  of  the  status  vector  is  given.  In  this  section  we  investigate  the 
case  where  the  status  of  some  of  the  affecting  events  may  be  unknown.  Towards  this  direc¬ 
tion,  we  derive  a  dynamic  programming  relationship  between  the  influence  constants  /?„(x") 

and/z„_i(x"“'),  where  /2„_i(x"“')  is  the  constant  corresponding  to  the  case  where  the  status  of 
the  affecting  event  ^„is  unknown.  We  express  a  lemma  whose  proof  is  in  Appendix  A  of  this 

report.  The  proof  is  based  on  the  observation  of  the  Bayes’  Rule  and  the  Theorem  of  Total 
Probability. 

Lemma  3.2 

Let  the  probability  P{b)  be  as  in  Section  II  and  let  P(x„  |  x""')  denote  the  probability  of  the 
value  of  the  last  bit  in  the  status  vector  X"  being  x„ ,  given  that  the  reduced  status  vector  val¬ 
ue  isx"“'.  Then,  the  influence  constant  is  given  as  a  function  of  the  influence  con¬ 

stant /z„(x")  ,  as  shown  below. 


ViW')  = 


I  a  ; 

\p{B)[\-P{B)rQ„  ;  0„g[O,P-'(5)-1] 


(3.6) 


where 
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(3.7) 


x„  =0,1 

We  note  that  the  influence  constants  are  deduced  from  the  same  constants  of  higher  di¬ 
mensionality,  as  shown  in  Lemma  3.2.  In  accordance,  conditional  probabilities  of  the  event  B 
are  produced  from  the  deduced  influence  constants,  via  expression  (3.4),  as: 


P(B  I X,"-')  =  F(i;){n-/i„_,(x,"-')[i  - 


x{l + 


_1  )l-sgn/t„_i(xf  ) 


(3.8) 


It  is  important  to  note  that  in  the  dynamic  programming  evolution  of  the  influence  con¬ 
stants (x" ) ,  as  well  as  in  the  evolution  of  the  conditional  probabilities  in  (3.7),  knowledge 

of  the  joint  probability  P(x”)  is  assumed.  This  reflects  a  conjecture  by  the  system  designer, 
based  on  his  /her  previous  experience  regarding  the  a  priori  occurrence  of  the  affecting 
events  (4  }i  ^ ^ •  Thus  the  probability  P(x")used  for  the  construction  exhibited  by  Lemma 
3.2  is  a  design  probability  and  it  may  not  coincide  with  the  actual  probabilities  of  the  status 
vector  X".  When  full  scale  dependence  of  the  components  of  the  status  vector  X”is  incor¬ 
porated  within  the  design  probability  P(x") ,  then  the  relationship  between  the  different  di¬ 
mensionality  influence  constants  is  that  reflected  by  Lemma  3.2  and  is  of  dynamic  program¬ 
ming  nature.  In  the  case  where  the  design  probability  P(x")  generically  reflects  either  a  Mar¬ 
kov  Chain  of  events  or  mutually  independent  events,  then  the  relationships  between  the  dif¬ 
ferent  dimensionality  influence  constants  may  be  also  of  recursive  nature.  The  cases  of  Mar¬ 
kovian  or  independent  affecting  events,  as  modeled  by  the  system  designer,  are  examined  in 
sections  3.4  and  3.5. 

3.4  The  Case  of  Independent  Affecting  Events 


In  this  section,  we  consider  the  special  case  where  the  affecting  events  {A^}i  <i<n  are  assumed  to 

be  generically  mutually  independent.  Then,  the  components  of  the  status  vector  X"  are  mutually 
independent,  and: 


P(x:)  =  llP(x,)  ;  P{x’1\B)  =  Y[P{x,\B) 

i=l  i=l 


(3.9) 


Let  us  denote  by  l^'\x.)ihQ  influence  constant  corresponding  to  the  effect  of  the  event  4  on  the 
occurrence  of  the  event  B,  when  event  A.  acts  in  isolation  and  when  the  status  value  of  the  event 
isXj .  Then,  from  expression  (3.4)  in  section  3.3,  we  have: 


P{B  I  X,)  =  P(5){l  +  ^(4x,)[l  -  P(5)]p-‘(5)f  .  {l  +  ^(4x,)}‘ 


-sg  nhi'Hxi) 


We  now  express  a  lemma  whose  proof  is  in  Appendix  A. 


(3.10) 
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Lemma  3.3 


Let  the  events  {4  }i  ^  ^ « that  affect  event  B  be  assumed  to  be  generically  mutually  independent. 
Then 


p[b  I  x;  )=  P{B)f[  {l  +  ^<')(x,)[l  -  P(5)]p-'(5)f  .  {l  + 


-sg  nh[^^  (x,  ) 


(3.11) 


i=\ 


Via  the  same  logic  as  that  in  the  last  part  in  the  proof  of  Lemma  2,  we  can  show  the  result  ex¬ 
pressed  in  the  corollary  below. 

Corollary  3.1 


When  the  affecting  events  are  assumed  to  be  generically  mutually  independent  then,  the  influ¬ 
ence  constant  /2„(x”)  is  given  as  a  function  of  the  single  event  influence  constants  < ;  <  « , 

as  follows: 


_l].  if  g  [l,F-'(fi)] 


(3^12) 


where 


R 


n 


=n  {i + (X,  )[i  -  p{B)]p-^ 


{l  +  A«(x,)}’ 


1-sg  nAj  (x,) 


(3.13) 


The  sequence  of  expressions  {R}\  <  j  < « in  (3. 13)  is  clearly  recursively  generated  and  the  condi¬ 
tional  probability  P(B  \  x")is  given  by  A„(x”)  as  in  (3.4)  in  section  3.2. 


We  note  that  the  consistency  condition  in  Lemma  3.1,  section  3.2  reduces  in  a  straight  forward 
fashion  and  by  construction  to  the  following  condition  here: 

y  P(x,){l  +  /,,(x,)[l  -  =  1;  V/ 

x,.=0,l 


or 

>1  )ti  -  -KslK'  (s)r '''  ’  =  0;  v; 

X,  =0,1 

3.5  The  Case  of  A  Markov  Chain  of  Affecting  Events 

In  this  section,  we  consider  the  case  where  the  affecting  events  {A^}i  <i<n  are  assumed  to  form 
generically  a  Markov  Chain.  In  particular,  we  assume  that  the  design  probabilities  P(x"  |  B)  and 
P(x")  are  such  that: 
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(3.14) 


P{x’l\B)  =  Y[P{x^x,_„B) 

i=\ 

p{x:)=f[p{x,\x,_,) 

i=\ 

where 


A  A 

P(Xj  I  Xo,5)=P(Xj  I  5)andP(Xj  I  Xo)=P(Xj) 

We  denote  by  /?j‘^'^(Xj)the  influence  constant  corresponding  to  the  effect  of  the  event  ^  on  the 
occurrence  of  the  event  B,  when  the  status  value  of  4 ,  is  given  by  Xj .  We  denote  by 
/22'’'^'^(x.,x.^j)  the  influence  constant  corresponding  to  the  effect  of  the  events  4  4+i  on  the 

occurrence  of  the  event  B,  when  the  status  values  of  the  (4,4+i)P^ii'  given  by  (x  ,x.^j) . 
Then,  via  (3.4)  in  section  3.2,  we  have 


P{B  I  Xj  )  =  P(B){\  +  (X, )[l  -  P(B)]p-^ ^  ’(-.) 


(3.15) 


p{b 


x„x,„)  =  P(5){l +  *»•“> 


(x,.,x 


„,)[l-P(5)]p-'(S)}’‘'*' 


(Xi  ) 


X 

;/  =  l 


(3.16) 


We  now  express  a  lemma  whose  proof  is  in  the  Appendix. 

Lemma  3.4 


Let  the  affecting  events  {4  }i  ^  ^ «  be  assumed  to  generically  form  a  Markov  Chain;  thus,  P(x”) 
is  assumed  to  satisfy  the  equation  in  (3.14).  Then, 


p(b  I  x;  )= P(5){l  +  (xi )[l  -  P(5)]p-‘ ^  ^  ^(1) 


{i+/?4 

'■-‘4x,,x,_4[i-p(5)]p-‘(5)j 

A.)j 

\l-sgnh^'’'  ^^(x,.,x,._i) 

1 

[i+4<'-'4x,_4[i-p(5)>>-'(5)] 

=P(B)W„ 


(3.17) 


where. 


p(s)[i-p(s)r[a,„-i] ;  ifa,Ms[i.^  '(s)] 


(3.18) 


24 


Vr^>84'’'"”(^,.%i)^|i^^(m+1) 


[i+f''^\^,^.,,)[i+/^^lF‘(5): 


(3.19) 


As  with  Corollary  3.1  in  section  3.4,  we  can  express  the  corollary  below,  in  a  direct  fashion. 

Corollary  3.2 

When  the  affecting  events  {4  }i  ^  ^ «  are  assumed  to  generically  form  a  Markov  Chain,  depicted 
by  the  expression  in  (3.14),  then,  the  influence  constant  A„(x")  is  given  as  a  function  of  the  in¬ 
fluence  constants  {h['\x-)}  and  below,  where  W^is  defined  in  (3.17). 


W)- 


lC-1 


ifK 


[P(5)[l  -  P(5)]-'  [ir„  - 1];  if  ir„  e  [l,  P-'  (P)] 


(3.20) 


The  sequence  {Wi}i  <i<n  in  (17)  is  clearly  recursively  expressed;  thus,  \(x")  is  recursively 
evolving.  The  consistency  condition  in  Lemma  3.1,  section  3.2,  takes  here  the  following  form,  by 


construction. 


X,  =0,1  x,_i=0,l 


xji+4, . 


=  1; 


Vz 


3.6  Temporal  Extension 

In  sections  3.2  and  3.3,  we  presented  our  theoretical  foundation  for  the  development  of  INs  and 
TINS,  while  in  sections  3.4  and  3.5,  we  focused  on  the  special  cases  of  independent  and  Marko¬ 
vian  affecting  events.  In  this  section,  we  focus  on  the  formalization  of  the  temporal  issues  in¬ 
volved  in  the  development  of  TINs.  In  particular,  we  are  investigating  the  dynamics  of  the  rela¬ 
tionship  of  the  affecting  events  {A^}\  <i  <nto  the  affected  event  B,  when  the  status  of  the  former 
evens  are  learned  asynchronously  in  time.  Without  lack  in  generality  -  to  avoid  cumbersome  no¬ 
tation  -  let  the  affecting  events  {A^}i  <i<n  be  ordered  in  the  order  representing  the  time  when 
their  status  become  known.  That  is,  the  status  of  events  4  is  first  known,  then  that  of  event  , 
and  so  on.  In  general,  the  status  of  event  4  becomes  known  after  the  status  of  the  events  4 —j4  i 
are  known,  and  this  knowledge  becomes  available  one  event  at  the  time. 

Let  us  assume  that  the  considered  system  model  implies  full  dependence  of  the  components 
of  the  status  vector  X" .  Then,  the  influence  constants  {h.{x")}\  <  <  < « - 1  are  first  pre-computed  via 
the  dynamic  programming  expression  in  Lemma  3.2,  section  3.2,  utilizing  the  pre-selected  a  pri- 


25 


ori  probabilities  P(x”)  that  are  part  of  the  given  system  parameters.  The  above  influence  con¬ 
stants  can  be  recursively  computed  if  the  adopted  system  model  implies  either  generically  inde¬ 
pendent  affecting  events  or  affecting  events  that  generically  form  a  Markov  Chain,  as  shown  in 
sections  3.4  and  3.5. 

Let  7^  denote  the  time  when  the  computation  of  the  system  dynamics  starts.  Let  7^  denote  the 
time  when  the  status  of  event  ,  becomes  known.  Let  ;  i  <  ^^  < « denote  the  time  when  the  status 
of  event  becomes  known.  Then  at  timeT^,  the  conditional  probabilities  F(Bjx^)  are  com¬ 
puted  via  expression  (3.4),  Section  II,  as, 

f(b  lx,^)=  F(B){l  +  h, (xf )[l - P(5)]P-' +  (xf ^  (3.21) 

i<k<n 

where  the  probability  F(B)  is  computed  via  the  consistency  condition  (5). 

As  the  knowledge  about  the  status  of  the  affecting  events  unravels,  the  conditional  probabili¬ 
ties  of  event  B  in  (3.21)  evolve  dynamically  in  time  and  finally  converge  to  the  probability 

F(B  I  x” )  at  time  T ,  when  the  status  of  all  the  affecting  events  become  known. 

It  is  important  to  point  out  that  the  conditional  probability  in  (3.21)  is  sensitive  to  the  time 
ordering  of  the  affecting  events.  That  is,  for  the  same  value  xf  of  a  partial  affecting  vector,  but 
different  time  ordering  of  events,  different  conditional  probabilities  values  of  the  affected  event 
B  arise.  Thus,  the  order  by  which  the  status  of  the  affecting  events  become  known  is  crucial  in 
the  evaluation  of  the  conditional  probabilities  of  event  B. 

3.7  Selection  and  Testing  of  the  Decision  Model 
Model  Selection 

As  we  have  discussed  earlier,  the  unconditional  probabilities  7’(x”)  as  well  as  the  influence  con¬ 
stant  /i„(x”)  are  design  parameters  that  may  not  represent  the  actual  parameters  correctly.  Fur¬ 
thermore,  as  discussed  in  section  3.2,  the  design  parameters  must  be  consistent,  where  consis¬ 
tency  is  represented  by  the  satisfaction  of  condition  (3.5)  in  Lemma  3.1.  Condition  (3.5)  can  be 
rewritten  as  follows,  in  a  straightforward  fashion. 

[i-p(5)]  Z  (3.22) 

xf  :sgn/t„  (xf  )=1  xf  :sgn/t„  (xf  )=0 

which  gives: 

F{B)=  ;whenX^(<K«)|^0  (3.23) 

xf  :sgn/t„(xf  )=1  |_  xf  J  xf 
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Example:  Let  us  consider  the  case  where  the  only  affecting  event  for  B  is  Ai. 


Let 


P(A,)^P{X=\)  =  p 

9 


where  then, 


P{A^^)tp{X^=0)  =  \-p 

Define  h  and  g  as  in  [5]  and  let  P(B)  be  what  has  been  called  in  [5]  base  probability  for  the 
event  B.  Then,  due  to  (3.22)  the  above  parameters  must  satisfy  the  following  equation(s): 

either  \[- P{B)]ph  =  P{B){\- p)\g\  ;  if/?>0andg<0 

or  \[-P{B)\\-p)g  =  P{B)p\h\  ;  if/?<0andg>0 

no  other  h  and  g  combinations  are  acceptable.  Note  that  parameters  h  and  g  in  [5]  map  to 
=  l)  and  h['\x^  =  O),  respectively,  in  Definition  3.1,  section  3.2. 

When  new  information  about  the  a  priori  probability  P{x")  is  obtained,  then,  P{B)  and/or 

need  to  be  accordingly  adjusted  to  satisfy  the  condition  in  (22).  We  note  that  the  latter  condition 
involves  a  number  of  free  parameters;  thus  even  specification  of  the  probabilities  P{B)  and 

P{x”)  does  not  specify  uniquely  the  values  of  the  influence  constant /i„(x”) .  Naturally,  specifica¬ 
tion  of  P{x")  and  h^{x")  uniquely  determines  the  probability P(5) ,  however,  as  in  (3.23). 

In  the  case  that  the  assumed  system  design  model  implies  generically  independent  affecting 

n 

events  {A^ji  <i<n,  then,  for  consistency  the  probability  P(5) ,  the  probability  P(x")  =  nm)of 

i=l 

the  status  vector  and  the  influence  constants  {h\'\x.)}  are  constraint  to  satisfy  the  condition: 

y /'(x,){l  +  A,(x,)[l  -  jl  +  )/“"*■<'''  =  1;  Vi  (3.24) 

x,=0,l 

Or 

X,  =0,1 

Model  Testing 

Since  the  “consistency”  constraints  allow  for  a  number  of  free  parameters,  we  will  focus  on  the 
influence  constant  /i„(x")  as  the  constant  to  be  tested,  when  information  about  the  probabilities  of 
the  events  {Ai}i  <i<n  and  B  is  obtained.  Thus,  model  testing  will  involve  comparison  of  the 
P(x")  and  P(5)  probabilities  assumed  in  the  model  with  those  computed,  to  test  the  validity  of 
the  assumed  influence  constant.  When  the  computed  P{x")  and  P{B)  values  do  not  satisfy  equa- 
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tion  (23)  for  the  assumed /2„(x") ,  then  a  non  valid  model  is  declared  and  a  new  influence  con¬ 
stant  /2„(x")  is  sought,  in  satisfaction  of  the  consistency  condition  in  (3.23). 


3.8  Some  Special  Influence  Constants 


As  noted  at  the  end  of  section  3.7,  the  influence  constant  is  a  important  component  of  the  system 
model:  the  appropriate  choice  of  this  constant  needs  to  be  carefully  thought  out,  to  accurately 
reflect  the  interleaving  of  partial  influences.  In  this  section,  we  study  some  specific  influence 
constants,  .  In  particular,  we  study  such  constants  that  are  specific  analytic  functions  of 

the  one-dimensional  components  4(a)  i ^  ^ •  We  note  that  we  are  not  mapping  the  {4  (A)}i<,<n 
constants  onto  conditional  probabilities  {P{B  \  x,)}j<.<^ .  Instead,  we  are  using  the  constants 
{4(A)}j^.<^to  construct  a  global  (x" )  influence  constant;  it  is  the  latter  constant  which  is 

mapped  onto  the  conditional  probability  P(5  [  x"),  as  in  section  3.2. 

The  h^ix")  corresponding  to  the  CAST  logic 

The  influence  constant  presented  below  is  that  used  by  the  CAST  logic  in  [4,  5,  9,  10,  11]. 

In  the  present  case,  given  the  constants  {4^'^(x,  )}i<,<„  the  global  influence  constant,  A„(x") ,  is 
defined  as  follows 


h„m  = 


n(i 

i:hi(xi)<0 


X 

/ 

max 

n(i- 

V(x,)|)  n(i-K'’(x,)) 

1 

i:hi(Xj)>0 

V 

i:hi(xi)<0 

i:hi(Xj)>0 

/_ 

(3.25) 


In  agreement  with  the  results  in  section  3.2,  and  via  (5)  in  Lemma  1,  the  global  constants  /i„(x") 
and  the  probabilities  P(x")  and  P(B)  must  satisfy  the  consistency  condition 


(3^26) 


Via  (4),  the  conditional  probabilities  P(B  \  x”)  are  then  given,  by  the  following  expression: 


p[b  I  x;  )  =  2P(5){i  +  (x;  )[l  -  i>(5)]F-'  (5)}*®"^"'^"'  X  {l  +  (x," )}’ 


l-sgn/!„(x") 


(3.27) 


For  maintaining  the  consistency  condition  in  (3.26),  the  conditional  probability  P{B  |  x”  ')  is 
defined  via  the  influence  constant  /i„_i(x"“')  as  in  Lemma  3.2,  Section  3.2,  where. 


p{B  I  xr‘ ) = p(5){i + h„_,  (xr‘  )[i  -  3P(5)]p-'  (5)}^*"^"-<^“  X  {i + h„_,  (xr‘ )}" 


■sgn /!„_,«  ') 


and 
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,  /  "-h-J  ’  Sh'=[®!1] 

'■[F(S)[l-P(5)]-'[e.-l]  ;  e„s[l,F-'(5)] 


a  i  I  ){i + w  )[i  -  p(s)]p-'  (s)}’*’*-'’"  X  [i + *,  (x’  ’ 


x„=0,l 


A  (x” )  Constant  Representing  Extreme  Partial  Values 


In  this  part,  we  first  define  the  effect  of  the  constants  )};<,<„  on  the  event  B  as  follows: 

If  at  least  one  of  the  constants  equals  the  value  1,  then  event  B  occurs  surely,  if  in 

addition  >  0 

(=1 

If  at  least  one  of  the  constants  equals  the  value  -1,  then  the  nonoccurrence  of  event 

n 

B  is  sure,  if  in  addition  <  0 

i=\ 

n 

The  events  {4  }i  ^ ^ «  do  not  affect  the  event  B  if  )  =  0 

(=1 


The  above  conditions  translate  to  the  following  initial  expressions  for  the  conditional  probability 
P{B  I  x” ) ,  where  x”  is  the  value  of  the  status  vector  of  the  affecting  events  {A^}i  <i  <n: 


p(B\x:)= 


1  ;  if  max  hf  (x,. )  =  1  and  V  hf  {x^ )  >  0 

\<i<n 

1=1 

p{B)  -if  =  o 

i  =  l 

0  ;  if  min  hf  (x,. )  =  - 1  and  V  hf  (x,. )  <  0 

\<i<n 


i=l 


(3.28) 


Via  linear  interpolation  from  the  above  expression  we  obtain  the  general  expression  of  the  condi¬ 
tional  probability  P(5  [  x”) ,  as  a  function  of  the  influence  constants  {V^(v  )}i</<« »  follows: 


P{B\xl)  =  { 


P(5)  +  max(<>(x,))[l-P(5)]  ;  X/j«(x,)>0 

\<i<n 


P{B) 

P{B)  +  minfo'\x,.))p(5) 

\<i<n  ^  ' 


i=l 


i=l 


i=l 


(3.29) 
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Defining  the  operators  Oix) 


A  (1  ;  x>0  Ah 

and  U(x)=l 

0  ;  x<0 


0 


x>0 

X  <  0 


,  we  can  rewrite  equation 


(29)  in  a  compressed  form  as  follows. 

P{B  I  Xj")  =  P(5)l  +  P-'(5)[1  -  P(5)]max  h{ 

^  \<i<n 


’(xj 


(  !*!'■’ (a:,  )) 


+  minV'Vx,.) 

\<i<n 


-U(Zh\‘Hx,)) 


(3.30) 


Next,  we  express  a  lemma  regarding  the  consistency  condition  for  our  present  model,  evolving 
from  the  application  of  the  Bayes’  Rule  and  the  Theorem  of  Total  Probability  on  (3.30).  The 
lemma  is  the  parallel  to  Lemma  3.1  in  section  3.2,  for  the  model  in  the  present  case. 

Lemma  3.5 


For  the  influence  model  expressed  in  (3.30),  the  probabilities  P(5) ,  P{x")  and  the  influence  con¬ 
stants  ^(x,)}i<,<„  must  satisfy  the  following  condition: 

[1-P(5)]  Y.  ^(<)max/ii<'>(x,.)  +  P(5)  Y  H<)min/ii<'>(x,.)  =  0  (3.31) 

i=\  i=\ 

From  the  consistency  condition  in  (3.31),  we  notice  that  when  examining  all  the  values  of  the 
status  vector X" ,  it  is  necessary  that  some  x”  vector  values  exist  such  that  rmxh^^\x^)  is  positive 

\<i<n 

and  that  some  x”  vector  values  exists  such  that  min  is  negative. 

\<i<n 


Temporal  Issues 

Here,  we  will  assume  that  the  very  existence  of  the  affecting  events  is  revealed  sequentially.  Let 
then  the  existence  and  the  status  of  the  events  {A^}\  <i<n  be  revealed  sequentially  in  time,  from 

to  ,  where  the  status  of  events  A^  to  A^^  is  known  at  time  .  At  time  ,  the  partial  status 
vector  xf  is  expressed  and  for  each  one  of  its  values,  the  probability  F'(xf )  and  the  quantities, 

A  ^  A  A 

S^_  (xf )  =  V  (x. ) ,  (xf  ) = max  (x,. )  and  (xf  ) = min (x,. )  are  computed.  Next,  the  prob- 

^  l<i<k  l<i<k 

i=l 

ability  P(B)  is  computed  from  (31)  as  follows: 


P{B)tp,{B) 


1-1 


YPi4)FM)- 


yp(x,')F,(x,‘) 

xt-.S,(xl)>0 


(3.32) 


Given  each  xf  value,  the  probability  P{B)  in  (3.32)  is  then  used  to  compute  the  conditional 
probability  P(5 1  xf  ),  as, 


P{B  I  xf )  =  P,(5){l  +  P,  \B)[\  -  P,(5)]F,(xf  )f ® 


{l  +  G,(xf)}‘- 


(3.33) 
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At  timer^+j ,  upon  the  revelation  of  the  existence  and  the  status  of  the  affecting  event  ,  for 
each  status  vector  ,  the  quantities,  +  x^^j , 

=  max(Fj^(xf  ),/z(x^^i)),  G^^iCxf"^')  =  min(G^(xf),/?i(x^^i))  are  first  recursively  com¬ 
puted.  Then,  the  probability  P{B)  is  recomputed  as 


/>(S)=F,.,(S) 


2;  P(x\"  (xf )  -  2  )G,.,  (4" ) 


-1 


(3.34) 


The  probability  in  (3.31)  is  used  to  compute  the  conditional  probability  below. 


F(B  I  xf*')  =  F,.,(fi){l  +  -F,.,(fi)]F,.,(x,**')f '“''“"{l  +  G,.,(x;*')f 


(3.35) 


We  note  that  the  time  evolution  of  the  conditional  probabilities  F(B  |  xf  )is  different  for  different 
time  orderings  of  the  affecting  events  {A^}\  <i  <n. 

A  linear  (x” )  Constant 

Here,  we  assume  that  the  effects  of  events  {x4,  }i  <i<n  on  event  B  are  weighted  by  a  known  set 

n 

{w  }i  <  I  < « of  weights,  such  that  w,.  >  0;  V/  and^  w,.  =  1 .  Then,  given  the  constants  , 

i=\ 

we  define  /2„(x")  as  follows,  for  some  given  value  or :  0  <  or  <  1 : 


(=1 


i=\ 


<\-a 


Km 


(=1 

i=\ 


A  nonzero  a  value  translates  to  the  probability  of  event  B  being  equal  to  one,  not  only  when  all 
the  {^i^‘^(x,  )}i<,<„  values  equal  one,  but  also  when  a  predefined  weighted  majority  exceeds  a  total 
weighted  sum  of  1  -  a  .  Similarly  then,  the  event  B  occurs  with  zero  probability  when  the 
weighted  sum  of  the  {^i^'^(x,  )}i<,<„  values  is  less  than  -  (1  -  a) ,  rather  than  only  when  it  equals  -1. 

The  relationships  between  the  /2„(x")  and  /2„_i(x”“')  influence  constants  and  the  probabilities 
PiB) ,  P(x")  and  P(B  \  x”)  are  as  in  IX.  A. 


31 


A  h^{x")  constant  representing  Noisy  OR  Format 

Given  the  constants  ,  we  define  here  as  follows;  where  a  is  such  that 

0<a<l: 


Then,  via  (3.3)  and  (3.5)  in  section  3.2,  we  obtain: 


P{B)  =  a  (3.37) 

l-PiB\x”)  =  Yl(l-\hi‘\x,)\)  (3.38) 

1=1 

The  expression  in  (3.38)  represents  the  Noisy-OR  format  [1,  4],  where  the  probabilities  in  the 
latter  are  here  substituted  by  the  absolute  values  of  the  one-dimensional  influence  constants 
■ 

Influence  Constant  Comparison 

Figure  3.2  shows  an  example  IN  with  a  binary  event  B  known  to  be  affected  by  the  events 
{A^  }i  <  /  <  3 .  The  edges  connecting  the  external  affecting  events  {A^  }i  <  i  <  3  to  the  event  B  are 

shown  annotated  with  the  constants  \h['^  (x.  =  l),  h['^  (x.  =  o)]for  each  i,  where  x^.  =  0, 1  represents 
one  of  the  two  states  of  an  affecting  event  A^ .  A  global  influence  constant  (xf )  is  then  de¬ 
signed  using  all  four  (i.e.,  A-D)  special  influence  functions  presented  in  this  section.  Table  3.1 
shows  the  computed  values  of  h^{xl)  and  corresponding  P{B  \  xf);  V  xf  for  each  of  the  four  cas¬ 
es.  For  illustration  purposes,  we  also  assume  that  the  joint  probability  P(xf ) ;  V  xf  values  are 
computed  by  assigning  P{x^  =  1)  =  0.8,  P{xj^  =  0)  =  0.2  and  P{x.  =  1)  =  P{x^  =  0)  =  0.5 ;  for  i  =  1,2  and 
by  assuming  {A.  }i  <  /  <  3  to  be  mutually  independent. 


Fig.  3.2  Example  TIN 
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TABLE  3.1  Comparison  of  Influence  Constants 


Xi 

X2 

X3 

h^{xl) 

P(B 

A. 

CAST  Log¬ 
ic  Based 

B. 

Extreme 

Partials 

C. 

Linear 

Constant 

D. 

Noisy- 

OR 

A. 

CAST 

Logic 

Based 

B. 

Extreme 

Partiais 

c. 

Linear 

Constant 

D. 

Noisy- 

OR 

0 

0 

0 

-0.33 

-0.33 

-0.073 

-0.095 

0.335 

0.335 

0.452 

0.463 

0 

0 

1 

-0.699 

-0.33 

-0.101 

-0.095 

0.150 

0.335 

0.452 

0.449 

0 

1 

0 

0.66 

0.66 

0.498 

0.326 

0.83 

0.83 

0.663 

0.749 

0 

1 

1 

0.242 

0.0 

0.0 

0.326 

0.621 

0.5 

0.663 

0.5 

1 

0 

0 

0.33 

0.33 

0.176 

-0.095 

0.665 

0.665 

0.452 

0.588 

1 

0 

1 

-0.33 

-0.33 

-0.044 

-0.095 

0.335 

0.335 

0.452 

0.478 

1 

1 

0 

0.847 

0.66 

1.00 

0.326 

0.923 

0.83 

0.663 

1.00 

1 

1 

1 

0.66 

0.66 

0.196 

0.326 

0.83 

0.83 

0.663 

0.598 

From  the  values  included  in  Table  3.1,  we  notice  the  sensitivity  of  the  computed  probability  of 
event  B  on  the  selected  structure  of  the  aggregate  influence  constant.  Different  such  structures 
reflect  different  environments  and  their  choice  is  at  the  discretion  of  an  expert. 

3.9  Evaluation  Metrics 


As  already  repeatedly  stated,  the  INs  and  TINs  studied  in  this  paper  are  basically  BNs  whose 
conditional  probabilities  are  approximated  by  expert  provided  influence  constants.  Thus,  the 
architectural  and  computational  complexities  involved  are  similar  to  those  in  BNs  [8,  31,  32,  33, 
34],  while  the  complexities  involved  in  the  computation  of  influence  constants  depend  on  the 
specific  structure  of  the  latter  (see  Section  VIII).  The  evolution  of  lower  dimensionality  condi¬ 
tional  probabilities  from  high  dimensionalities  ones,  as  in  Lemma  3.2,  section  3.2,  is  of  dynamic 
programming  nature  inducing  polynomial  complexity.  As  stated  in  section  3.7,  the  accuracy  of  a 
IN  or  TIN  model  is  determined  by  the  accuracy  of  the  selected  influence  constants.  The  accura¬ 
cy  of  the  latter  may  be  tested  and  they  may  be  subsequently  adjusted  appropriately. 

3.10  Experimental  Setup 

In  this  section,  we  lay  out  the  steps  involved  in  an  experimental  setup.  Given  an  event  B,  deter¬ 
mine  all  the  events  {4}i  £  <  £ «  known  to  be  affecting  its  occurrence.  Given  B,  all  the  known  af¬ 
fecting  events  {A^}\  <i<n,  and  the  causal  strengths  =  O)]  between  each  and  B, 

design  an  influence  constant  h^{x") ,  where  x"  signifies  the  value  of  the  status  vector  of  the 
events  {A^}i  <i<n,  and  where  - 1  <  /z„(x")  <  1 ;  V  x"  values.  The  /2„(x”)  constant  may  have  one  of 
the  forms  presented  in  section  3.8.  If  all  in  (b)  is  given,  then  upon  a  given  probability  of  the  sta¬ 
tus  vector  X" ,  say  P(x") ;  V  x"  values,  the  probability  of  event  B  is  given  by  the  following  equa¬ 
tion,  named  the  consistency  equation. 


Hi  +  KW] 


l-sgn/t„  (xf  ) 


=  1 
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whose  equivalent  form  is: 


P(B)  = 


x"  :sgn/t„  (xj”  )=1 


x," 


if  the  denominator  is  non  zero 


When  all  the  affecting  events  {A^}i  <i<n  are  known,  but  the  status  of  some  of  them  are  unknown, 
then,  the  probability  P{B) ,  as  computed  in  step  (c)  is  used  to  compute  the  conditional  probability 
P{B  I  xf ) ,  when  the  status  vector  of  only  k  affecting  events  is  known  as: 

P{B  I  xf )  =  P(5){1  +  ^  •  {1  +  \(xf  ^ 

where  h^{x^)  is  computed  in  a  dynamic  programming  fashion  from  the  influence  constant 


h„(x”)  in  (b);  as  follows: 

^-\p(^B)[\-P{B)Y\Q„-n  ;  0„e[l,p-'(5)] 
for  Q,i  +  + 

x„  =0,1 

We  note  that  in  the  above  expression  ,  the  affecting  events  {A^}i  <i<n  are  assumed  ordered  as  of 
the  revealing  of  their  status  in  time.  Different  such  ordering  results  in  different  evolutions  of  the 
conditional  probabilities  P{B  |  xf  ) . 

When  the  existence  as  well  as  the  status  of  the  affecting  events  are  sequentially  revealed,  then  at 
time  k,  7^(5)  and  Pj^{B  \  xf )  are  computed  as  in  (c)  and  (d)  where  n  is  substituted  by  k  in  the  lat¬ 
ter. 


Example  1 :  The  following  example  illustrates  the  steps  (a)  to  (e)  with  the  help  of  an  example 
TIN.  Figure  3.3  shows  a  IN  with  a  binary  event  B  known  to  be  affected  by  the  events  {^,}i  <  j  <  4. 

The  edges  connecting  the  external  affecting  events  {A.}i<i<4  to  the  event  B  are  shown  in 
Fig.  3,  annotated  with  the  constants  [/2f*^(x,.  =l),h^'\x.  =o)]for  each  i,  where  x,.  =  0, 1  represents 
one  of  the  two  states  of  an  affecting  event  A^.  A  global  influence  constant  h^(x^)is  then  de¬ 
signed  using  the  CAST  logic  expression  (25)  in  section  3.8.  Table  3.2  shows  the  computed  val¬ 
ues  for/z4(xf ); Vxf .  The  joint  probabilityP(xf);Vxf values  are  computed  by  assigning 

P(xi  =l)  =  P(x,.  =0)  =  0.5;Vz  and  by  assuming  {^.}i<;  <4  to  be  mutually  independent  (Lemma 

3).  The  probability  of  occurrence  of  event  B,  i.e.,  z  =  1,  is  now  calculated  with  the  consistency 
equation,  and  is  given  as  P{z  =  1)  =  0.5  .  Assuming  the  status  of  all  the  affecting  events  to  be 

known,  the  conditional  probabilities  P(5 1  xf);Vxf  are  calculated  via  expression  (26),  and  are 
shown  in  Table  3.2. 
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[h/(l)  =  0.99, 
hi‘(0)  =  -0.99] 


Fig.  3.3  Example  TIN 

The  assumption  in  step  (iii),  regarding  the  knowledge  of  the  status  of  all  the  affecting  events, 
may  not  be  valid  at  times.  Such  is  the  case  of  a  TIN  with  delays  on  edges  (see  Definition  3.1), 
reflecting  variations  in  the  times  when  the  status  of  the  affecting  events  become  known.  To  illu¬ 
strate  this  notion,  we  add  temporal  information  to  the  IN  in  Fig.  3.3.  The  added  temporal  infor¬ 
mation  together  with  the  underlying  graph  is  shown  in  Fig.  3.4.  The  time  assigned  to  an  affecting 
event  A.  is  the  instance  at  when  it  assumes  a  state,  i.e.,  x.=  0  or  1.  Prior  to  that  time,  the  state  of 

the  event  is  assumed  unknown.  As  stated  in  Definition  3.1,  this  combination  of  the  external  af¬ 
fecting  events’  status  and  their  timing  is  also  termed  a  Course  of  Action  (CO A),  in  the  TIN  lite¬ 
rature. 


TABLE  3.2  Conditional  Probabilities 


X, 

X4 

F\z  =  \ 

0 

0 

0 

0 

-0.990000 

0.005000 

0 

0 

0 

1 

-0.999900 

0.000050 

0 

0 

1 

0 

-0.900000 

0.050000 

0 

0 

1 

1 

-0.999000 

0.000500 

0 

1 

0 

0 

-0.900000 

0.050000 

0 

1 

0 

1 

-0.999000 

0.000500 

0 

1 

1 

0 

-0.000001 

0.499999 

0 

1 

1 

1 

-0.990000 

0.005000 

1 

0 

0 

0 

0.990000 

0.995000 

1 

0 

0 

1 

0.000001 

0.500001 

1 

0 

1 

0 

0.999000 

0.999500 

1 

0 

1 

1 

0.900000 

0.950000 

1 

1 

0 

0 

0.999000 

0.999500 

1 

1 

0 

1 

0.900000 

0.950000 

1 

1 

1 

0 

0.999900 

0.999950 

1 

1 

1 

1 

0.990000 

0.995000 

35 


The  temporal  information  in  the  TIN,  Fig.  3.4,  determines  the  dynamics  of  the  relationship 
between  the  affecting  events  and  the  affected  event  B;  specifically,  the  times  when  the  status  of 
the  affecting  events  are  revealed  to  B.  Figure  3.5  shows  a  IN  equivalent,  obtained  by  mapping 
the  status  of  the  affecting  events  and  their  effects  on  the  event  B,  on  a  timeline.  This  mapping 
determines  the  number  of  affecting  events  ‘k’  at  different  time  points  (or  time  slices).  For  the 
temporal  case  presented  in  section  VI,  the  existence  of  all  the  affecting  events  is  known  to  the 
event  B  a  priori;  their  status,  however,  remain  unknown  until  revealed,  as  determined  by  the 
COA  and  the  delays  on  the  edges.  The  probability  P(5) ,  as  calculated  in  step  (c),  is  used  to  com¬ 
pute  the  conditional  probabilities  P{B  \  xf  );A:  =  1, 2, 4 ,  i.e.,  P{B  |  xj) ,  P{B  |  xf ) ,  and  P{B  \  Xj"*) 
,as  illustrated  in  the  figure.  Table  3.3  shows  the  values  forP(5|Xj)andP(51Xj^),  as  computed 
by  the  corresponding and/i2(x() .  The  posterior  probability  of  B  captures  the  impact  of  an 

affecting  event  on  B  and  can  be  plotted  as  a  function  of  time  for  a  corresponding  COA.  This  plot 
is  called  a  Probability  Profile  [12,  27].  Fig.  3.6  shows  the  resulting  probability  profile  for  the  il¬ 
lustrative  example.  The  plotted  values  in  the  profile  are  shown  with  bold  letters  in  Tables  3.3- 
3.4.  The  overall  complexity  is  polynomial. 

For  the  temporal  case  presented  in  section  IX,  the  existence  as  well  as  the  status  of  the  affect¬ 
ing  events  are  not  known  a  priori  but  are  determined  by  the  given  COA  and  the  delays  on  the 
edges.  At  time  k,  7^(5)  and  Pj^^B  \  x^)  are  computed  as  in  (c)  and  (d)  where  n  is  substituted  by  k 

in  the  latter.  Table  3.4  shows  the  computed  values  of  andP4(5  |  xf  );A:  =  l,2,4and  Fig. 
3.6(b)  shows  the  resulting  probability  profile. 


Fig.  3.4.  Example  TIN  with  COA  and  Edge  Delays 

I  I 
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Fig.  3.5.  Temporal  Model  for  the  Example  TIN 


TABLE  3.3  Posterior  Probabilities  of  B 


X, 

II 

X, 

II 

0 

0.076381 

0 

0 

0.013887 

1 

0.923619 

0 

1 

0.138875 

1 

0 

0.861125 

1 

1 

0.986113 

TABLE  3.4  Probability  Profile  values 


x. 

P^B) 

II 

x. 

X, 

P,(B) 

P(z  =  l|xf) 

Xi 

X| 

X4 

x^ 

PAB) 

P{z  =  ^xA 

0 

0.005 

0 

0 

0.005 

0 

0 

0 

0 

0.5 

0.005 

1 

0.5 

0.995 

0 

1 

0.005 

0 

0 

0 

1 

0.005 

1 

0 

0.995 

0 

0 

1 

0 

0.005 

1 

1 

0.5 

0.995 

0 

0 

1 

1 

0.005 

0 

1 

0 

0 

0.005 

0 

1 

0 

1 

0.005 

0 

1 

1 

0 

0.95 

0 

1 

1 

1 

0.005 

1 

0 

0 

0 

0.005 

1 

0 

0 

1 

0.995 

1 

0 

1 

0 

0.05 

1 

0 

1 

1 

0.995 

1 

1 

0 

0 

0.995 

1 

1 

0 

1 

0.995 

1 

1 

1 

0 

0.995 

1 

1 

1 

1 

0.995 
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(a).  For  Temporal  Case  I 


1  n _ 

0.99  - 
0.9S  - 
0.97  - 
S  0.96  - 
0.95  - 
0.94  - 
0.93  - 

0.92  ^ ^ - r 

0  12  3 

Time 

(b).  For  Temporal  Case  II 


Fig.  3.6.  Probability  Profile  for  the  Example  COA 

Example  2:  In  multi-node  connected  network  structures,  given  a  set  of  external  unaffected  af¬ 
fecting  events  }. ,  given  influence  constants  [h^  (xf  )}^ ,  pertinent  conditional  probabilities  are 

constructed  hierarchically,  as  the  structure  of  the  network  dictates.  Consider,  for  example,  the 
network  in  Fig.  3.7,  below.  In  this  network,  the  affecting  events  ;i  =  l,  2, 3, 4 are  external  and 
unaffected  by  other  events,  while  events  B  and  C  are  affected,  B  being  affecting  as  well.  Let  us 
denote  the  status  of  events,;  /  =  1, 2, 3, 4 ;  byx. ,  the  status  of  event  B  by  y  and  the  status  of  event 

C  by  z,  where  y,  z  and  are  O-I  binary  numbers.  Let  the  influence  constants 

/2(Xj , X2 ),  h(x^ , X4 )  and  h(y, Xj , X4 )  be  given.  Let  also  the  joint  probability  P(Xj ,  X2 , X3 , X4 )  be  given. 


Fig.  3.7.  A  Multi-node  Network 

We  then  compute  all  the  pertinent  probabilities  in  the  above  network  following  the  steps  stated 
below: 

1.  Compute  the  probability  P(y)from  the  consistency  condition: 


X  P(xi ,  Xj  ){l  +  h(x, ,  X2  )[l  -  7"(y  )]/"■'  (y)}'®  ”  ^{l  +  h(x„  =  I 

Xi  ,X2 
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where, 

p{x^,x^)=  Y^p(x^,x^,x^,x^) 


X3,X4 


2.  Compute  P{y  |  Xj,X2)  from, 

P{y  I  Xi , X2 )  =  P(;^){l  +  A(xi  , X2  )[l  -  P{y)]P~'  (j)}' 

3.  Compute  P(j,X3,X4)as: 

P(j,X3,X4)=  ^^(3;  I  Xi,X2)P(Xi,X2,X3,X4) 


lsgn/t(xi,X2) 


Xi,X2 


4.  Compute  P{z)  from  the  eonsistency  condition 

2]P(y,X3,X4){l  +  h{y,x^,xj^  -  +  h{y,x^,x^)Y'^''''^^’’‘^'''*^  =  1 

;;,X3,X4 

5.  Compute  P{z  |y,X3,X4  )from, 

P(z  I  y ,  X3 ,  X4 )  =  P(z){l  +  h{y,  x^ ,  X4  )[l  -  P(z)]P“‘  (z)}'®” ^  {l  +  h{y,  X3 ,  X4 * 

6.  Compute  P{z  |  Xj , X2 , X3 , X4 )  from, 

p(z  I  Xi,X2,X3,X4)  =  ^p(z,y  I  Xi,X2,X3,X4)=  2^p(z  |  y , X3 , X4 )p(y , |  Xi,X2) 


3.11  Conclusion 

In  this  chapter,  we  presented  a  comprehensive  approach  to  Influence  Nets  including  conditions 
for  model  consistency  and  dynamic  programming  evolution  of  the  influence  constants,  as  well  as 
temporal  issues  and  model  testing  methodologies.  We  revisited  the  earlier  CAST  logic  [4,  5] 
based  approach  to  Timed  Influence  Network  (TIN)  modeling  [13,  15,  17],  by  redefining  the  de¬ 
sign  parameters  for  a  TIN  model,  reevaluating  the  cases  of  independence  and  (partial)  depen¬ 
dence  among  external  affecting  events,  introducing  new  methods  for  aggregating  joint  influences 
from  design  parameters,  and  by  offering  new  insights  into  the  temporal  aspects  of  causal  influ¬ 
ences  modeled  inside  a  TIN.  The  presented  approach  successfully  overcomes  the  deficiencies  in 
the  CAST  logic  based  TIN  modeling  and  the  inconsistencies  therein.  It  also  does  not  require  any 
additional  design  information  than  that  already  available  in  a  TIN  constructed  via  CAST  logic 
parameters;  the  entire  repository  of  situational  models  developed  earlier  [15,  17,  18]  may  be 
simply  reanalyzed  (without  any  modifications)  using  the  new  set  of  computational  tools  intro¬ 
duced  in  this  paper.  We  analyzed  and  evaluated  our  approach  and  tested  it  for  a  specific  TIN. 
This  illustrative  application  is  presented  in  Chapter  5.  The  approach  produces  consistent  and  sta¬ 
ble  in  time  results. 
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Chapter  4 


Meta-Model  Driven  Construction  of  Timed  Influence  Nets 

Faisal  Mansoor,  Abbas  K.  Zaidi,  Alexander  H.  Levis 


4.1  Introduction 

The  analysis  and  decision  problems  often  require  modeling  of  subjective,  informal,  and  uncertain 
concepts  in  a  domain  in  order  for  an  analyst  to  capture  the  required  behavior  of  the  domain.  In¬ 
fluence  Net  (IN)  [36],  a  variant  of  Bayesian  Networks  (BN),  is  an  approach  for  modeling  cause- 
and-effect  relationships  among  variables  of  a  domain.  The  construction  of  an  IN  requires  a  sub¬ 
ject  matter  expert  (SME)  to  model  the  parameters  of  the  domain  -  random  variables  -  as  nodes 
in  a  network.  The  arcs  (or  directed  edges)  in  the  network  represent  the  cause-and-effect  relation¬ 
ships  between  the  random  variables.  The  nodes  in  an  IN  and  their  interdependencies  may 
represent  the  inter  effects  between  political,  military,  economic,  social,  infrastructure,  and  infor¬ 
mation  (PMESII)  factors  present  in  an  area  of  interest.  The  strengths  of  these  dependencies  are 
captured  in  terms  of  a  small  (i.e.,  linear)  number  of  influence  constants  (as  opposed  to  an  expo¬ 
nential  number  of  conditional  probabilities  in  a  BN).  The  IN  approach  was  developed  in  recogni¬ 
tion  of  the  fact  that  most  domain  experts  and  situation  analysts  do  not  think  in  terms  of  condi¬ 
tional  probabilities  (as  required  for  a  BN)  while  relating  affecting  and  effect  variables  in  a  do¬ 
main.  The  INs  provide  an  intuitive  elicitation,  update,  and  merge  interface  to  an  underlying  BN 
that  only  requires  specification  of  qualitatively  described  individual  influences  between  each  pair 
of  an  affecting  and  an  affected  variables.  The  approach  then  combines  these  individual  influ¬ 
ences  to  calculate  the  aggregate  effect  of  multiple  affecting  variables  on  an  effect  variable  in 
terms  of  conditional  probability  values  of  a  resulting  BN. 

Wagenhals  and  Levis  [13]  have  added  a  special  set  of  temporal  constructs  to  the  basic  for¬ 
malism  of  Influence  Nets.  The  Influence  Nets  with  these  additional  temporal  constructs  are 
called  Timed  Influence  Nets  (TINs).  A  fully  specified  TIN  model  is  characterized  by  the  causal 
relationships  between  propositions  and  the  values  of  the  parameters,  i.e.,  strength  of  influences 
[22],  and  temporal  delays  associated  with  these  relationships.  TINs  have  been  experimentally 
used  in  the  area  of  Effects  Based  Operations  (EBOs)  and  Adversarial  Modeling  for  evaluating 
alternative  courses  of  actions  and  their  effectiveness  to  mission  objectives  in  a  variety  of  do¬ 
mains,  e.g.,  war  games  [15]  ,  and  coalition  peace  operations.  A  number  of  analysis  tools  have 
been  developed  over  the  years  for  TIN  models  to  help  an  analyst  in  solving  problems  of  interest 
[22  -  24].  In  this  sequel,  the  term  Influence  Net  (IN)  will  be  used  generically  to  refer  to  both  INs 
and  TINs. 

The  lack  of  familiarity  with,  or  enthusiasm  for,  these  analytical  representations  (i.e.,  BNs 
and/or  TINs)  prevents  most  domain  experts  and  analysts  from  developing  such  models  on  their 
own  and  using  them  for  the  analysis  tasks  assigned.  The  tools  implementing  some  of  these  for¬ 
malisms  [37  -  38]  require  prior  knowledge  and  experience  in  modeling  and,  therefore,  do  not 
provide  any  assistance  to  such  users.  There  is,  however,  a  growing  community  of  analysts  who 
makes  use  of  these  analytical  and  quantitative  formalisms  resulting  in  a  small,  but  expanding, 
repository  of  models  addressing  different  PMESII  aspects  of  a  domain.  There  is,  therefore,  a 
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need  not  only  to  facilitate  the  model  building  task,  but  also  to  utilize  the  existing  models  for 
building  quick,  larger  and  better  domain  models  without  requiring  experienced  domain  experts, 
at  least,  in  the  early  stages  of  a  domain  modeling  exercise. 

This  chapter  introduces  a  meta-modeling  approach  that  facilitates  generalizing  an  entire  class 
of  problem- specific  TINs  in  the  form  of  a  meta-model,  called  Template  TIN.  For  example,  a 
causal  relation  in  an  existing  TIN  might  model,  “If  the  Kurd  population  in  the  Northern  provinc¬ 
es  of  Iraq  finds  its  rights  respected  in  the  new  administration,  then  it  will  be  more  cooperative  in 
the  new  development  plans.”  A  simple  generalization  of  this  could  be,  “If  an  <ethnic  minority> 
in  a  <geographic  administrative  unit>  finds  its  rights  respected,  then  it  will  <participate>  in  the 
<development  activity> A  Template  TIN  captures  such  generalized  relation  using  abstract 
entities  characterizing  a  problem  domain.  It  can  be  constructed  by  generalizing  several  TINs,  or 
can  be  directly  constructed  by  an  expert  using  the  template  specification  language.  A  set  of 
stored  templates  can  then  be  instantiated  for  a  particular  situation  by  substituting  abstract  entities 
with  concrete  instances  characterizing  a  situation. 

A  Template  TIN  provides  a  means  for  leveraging  past,  tested  TIN  models  that  may  have  been 
constructed  by  other  experts  or  team  of  experts  in  addressing  a  problem  similar  to  the  one  under 
consideration.  It  simplifies  the  Influence  Net  construction  process  by  providing  an  analyst  with  a 
repository  of  templates  capturing  different  fragments  of  a  generalized  understanding  of  the  prob¬ 
lem  domain  in  terms  of  possible  causal  relationships  among  domain  variables.  These  templates 
are  not  intended  to  prescribe  a  solution  or  a  model  but  are  a  means  to  enhance  an  analyst’s  search 
for  better  understanding  of  the  domain  and  to  facilitate  the  process  of  building  a  more  pertinent 
model  of  the  domain.  A  Template  IN  identifies  a  set  of  concepts  that  are  considered  relevant  by 
some  analyst  or  a  team  of  analysts  for  a  problem-specific  domain.  These  concepts  are  described 
at  an  abstract  level  and  are  required  to  be  instantiated  when  a  model  is  being  constructed  for  a 
new  domain.  Exploring  available  knowledge  bases  for  information  required  for  instantiating  a 
Template  TIN  is  also  a  complex  and  time-consuming  task,  especially  if  that  information  is  not 
implicitly  available  in  the  form  of  an  expert  of  the  new  domain.  With  increasing  popularity  and 
use  of  structured  knowledge  representation  and  reasoning  tools,  it  is  now  possible  to  automate 
the  data  exploration  and  Template  TIN  instantiation  process.  In  the  presented  framework,  we  use 
an  OWL  [39]  ontology  not  only  as  the  knowledge  representation  for  domain  data,  but  also  as  a 
mechanism  to  reason  about  this  data  while  constructing  a  situational  assessment  model  as  a 
Timed  Influence  Net.  For  a  fully  automated  instantiation  of  a  Template  TIN  with  the  data  in  an 
ontology,  the  approach  proposes  a  mapping  scheme  that  provides  a  definition  of  abstract  con¬ 
cepts  present  in  the  Template  TIN  in  terms  of  concepts  and  properties  available  in  the  ontology. 
These  definitions  are  constructed  as  a  set  of  mapping  rules.  The  mapping  rules  are  SPARQL 
(Protocol  and  RDF  Query  Language)  [40]  queries  that  use  the  OWL  reasoning  engine  Pellet  [41] 
to  identify  relevant  data  in  the  ontology  to  be  used  for  TIN  instantiation. 

The  rest  of  the  chapter  is  organized  as  follows.  In  section  4.2,  we  present  the  architecture  of 
the  developed  meta-model  driven  ontology  based  TIN  construction  approach.  Section  4.3 
presents  how  this  approach  can  aid  in  developing  situation  assessment  model  for  some  class  of 
problems.  Section  4.4  contains  an  example  while  4.5  concludes  the  paper  with  a  discussion  on 
future  research  directions. 
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4.2  The  Methodology 

Figure  4. 1  shows  an  overview  of  the  meta-model  driven  ontology  based  TIN  construction  ap¬ 
proach.  The  following  subsections  describe  each  component  of  the  architecture  in  Fig.  4.1. 


Fig.  4.1  Architecture  of  the  Approach 


Ontology 

Ontology  is  an  explicit  conceptualization  of  some  domain  of  discourse.  We  can  define  an  ontol¬ 
ogy  as  a  knowledge  base  composed  of  Terminology  Box  (TBox)  and  Assertion  Box  (ABox);  K  = 
(TBox,  ABox),  where: 

•  TBox  is  a  finite  set  of  concepts  and  a  finite  set  of  relations  between  the  concepts. 

•  ABox  is  a  finite  set  of  instances,  relations  between  instances  and  relations  between  in¬ 
stances  and  concepts  in  TBox. 

In  Fig.  4.1,  the  terms  Template  Ontology  and  Ontology  refer  to  the  TBox  and  the  ABox  of  an 
ontology,  respectively. 

Template  Timed  Influence  Net  (TIN) 

An  Influence  Net  for  a  problem  instance  involves  a  pre-specified  set  of  random  variables  with 
fixed  cause-and-effect  relationships.  The  goal  of  Template  Timed  Influence  Net  is  to  capture  the 
abstract  relationships  between  classes  of  causes  and  effects  characterized  by  a  problem  domain. 
Template  TINs  extend  TINs  just  as  first-order  logic  extends  propositional  logic. 

Template  TINs  are  Influence  Nets  except  that  the  nodes  in  them  contain  labels  formed  by  va¬ 
riables  instead  of  terms  representing  domain  instances.  Formally,  a  Template  Influence  Net  is 
described  as  follows: 

Definition  4.1  -  A  Template  TIN  is  a  tuple  {V,  E,  C,  E)  where  G{V,  £)  is  a  Directed  Acyclic 
Graph  (DAG),  and 
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•  F  is  a  set  of  random  variables  that  makes  up  the  nodes  of  an  Timed  Influence  Net.  Where 

o  All  the  variables  in  the  Timed  Influence  Net  have  binary  states. 

o  For  each  random  variable  v  E  V  there  exists  a  set  of  slot  variables  svar(v)  such 
that  each  slot  variable  in  svar(v)  represents  an  abstract  domain  entity. 

•  F  is  a  set  of  directed  links  that  connect  pairs  of  nodes  in  V. 

•  C  is  a  set  of  causal  strength  parameter  and  the  time  delay  triples.  Each  triple  in  C  is  asso¬ 
ciated  with  an  edge  in  E  (the  causal  strength  parameters  are  usually  denoted  as  h  and  g  val¬ 
ues). 

•  B  represents  a  set  of  baseline  and  prior  probabilities  associated  with  non-root  and  root 
nodes  respectively. 

Definition  4.2  (Template  Influence):-  A  Template  Influence  7]  in  a  Template  TIN  is  a  tuple 
{sr,  tr,  e,  M  (T])},  where  sr,  tr  EV,e  E  E,  and  sr  is  the  source  node  of  e  and  tr  is  the  target 
node  of  e.  In  addition,  Af  (7])  is  a  function  providing  a  mapping  from  svar^sr)  U  svar(tr')  to 
situation  specific  entities. 

A  Template  TIN  is  a  collection  of  several  Template  Influences.  An  example  Template  Influ¬ 
ence  is  shown  in  Fig.  2a.  The  terms  [?leader]  and  [?funding]  represent  the  slot 
riables  svar{sr)  and  svar(tr),  respectively. 

Mapping  Box 

Mapping  Box  defines  influences  present  in  a  Template  TIN  in  terms  of  concepts  and  relation 
available  in  a  Template  Ontology.  Specifically,  Mapping  Box  is  a  set  of  mappings  where  each 
mapping  is  defined  as  a  pair  consisting  of  a  Template  Influence  and  an  ontology  query  (Fig.  2b), 
the  query  establishes  the  link  between  Template  Influence  and  ontology. 


[deader]  issues 
prepa  rate  IV  order 
(0.5)  sr 

€ 

I>fundiftg]  Available 

(0.5)  ^ 

(a)  Template  Influence 


Select  ? leader,  ?fundin:g 
where 

(?leader  instanceOf  KnownTerrorist) 

(? leader  leadersliiE>Ranik  highj 
(^observationL  instanceOf  CZObservation) 

(?observationL  hasParticipant  ?leader) 

{?funding  in&tanceOf  FirtartdalSource) 

i?observstionF  instanceOf  Financial AquasitionOb^ervalion) 

{?<3h5ervattQnF  hasFinancialSQMrce  ^funding) 


(b)  Ontology  Query 
Fig.  4.2  An  Example  Mapping 

Timed  Influence  Net  Generator 

Given  an  ontology  (i.e.,  TBox  and  ABox  both)  describing  a  particular  situation,  TIN  Genera¬ 
tor  uses  the  abstract  definitions  available  in  the  Mapping  Box  to  produce  a  TIN  specialized  for 
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the  situation  described  by  the  input  ontology.  For  the  example  in  Fig.  4.2  this  would  amount  to 
running  the  query  in  Fig.  4.2b  for  identifying  the  instances  in  the  ontology  that  match  with  the 
conditions  defining  the  slot  variables  [?leader]  and  [?fimding]  in  the  Template  Influence  (Fig. 
4.2a).  The  results  of  the  query  are  then  substituted  for  the  slot  variables.  The  following  is  a  for¬ 
mal  definition  of  this  substitution  process. 

Definition  4.3  (Substitution):-  Let  be  a  term  denoting  a  situation  specific  entity  belonging  to  a 
domain  of  interest.  Then  a  substitution  6  =  [v^/ti }  is  an  assignment  of  term  tj  to 
variable  Vi.  Applying  a  substitution  6  to  Template  Influence  7]  yields  the  instantiated  Influence 
where  all  occurrences  of  the  variable  Vi  are  simultaneously  replaced  by  the  term  tj. 

As  shown  in  Fig.  4.1,  the  presented  TIN  construction  approach  is  a  two-phase  process  con¬ 
sisting  of  a  Domain-Modeling  phase  and  a  Situation-Modeling  phase.  In  the  Domain-Modeling 
phase,  ontology  and  TIN  templates  are  used  to  develop  a  generalized  mapping  that  can  be  ap¬ 
plied  to  any  ontology  compatible  with  the  Template  Ontology.  Domain-Modeling  is  a  process 
done  only  once.  When  a  Mapping  Box  is  created,  instantiating  a  TIN  from  a  given  instance  on¬ 
tology  describing  a  particular  situation  becomes  a  completely  automated  process. 

4.3  Castalia 

The  described  meta-model  driven  ontology  based  TIN  construction  process  has  been  imple¬ 
mented  as  part  of  the  Pythia  [38]  suite  of  applications.  The  implemented  software  package, 
called  Castalia,  takes  as  input  (a)  an  OWL  [39]  ontology  expressed  in  Protege  [41],  (b)  mapping 
rules  expressed  in  SPARQL  [40],  and  (c)  Template  TIN  developed  using  Pythia  application  [38] 
for  instantiating  TINs.  Pellet  [41]  is  used  as  the  ontology  reasoning  and  query  engine  by  Casta¬ 
lia.  The  output  of  Castalia  can  be  imported  in  Pythia  as  a  Timed  Influence  Net  for  subsequent 
analysis. 

An  implementation  view  of  the  architecture  in  Fig.  4. 1  is  shown  in  Fig.  4.3. 


domain  ModfUi>o 


Fig.  4.3  Architecture  with  Respective  Applications 

From  a  procedures  point  of  view.  Figs.  4.3  and  4.4  illustrate  how  a  team  of  analysts  and 
knowledge  engineers  can  use  Protege,  Pythia,  and  Castalia  to  automate  the  Influence  Net  con¬ 
struction  process. 
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The  process  in  Fig.  4.4  comprises  of  two  phases:  Domain  Modeling  and  Situation  Modeling. 
In  the  Domain  Modeling  phase,  Protege  is  used  to  develop  the  Template  Ontology  and  Pythia  is 
used  to  develop  the  Template  TIN.  The  Template  Ontology  can  be  developed  by  a  knowledge 
engineer  with  technical  knowledge  of  OWL  and  Protege  ,  and  some  understanding  of  the  prob¬ 
lem  domain.  A  Template  TIN  can  be  developed  by  a  domain  expert  with  no  or  little  help  from  a 
knowledge  engineer.  A  Template  TIN  can  also  be  derived  by  generalizing  already  developed 
TIN  models.  The  derivation  of  Template  TIN  in  the  latter  case  can  be  done  by  a  knowledge  en¬ 
gineer  with  no  or  little  help  from  an  analyst.  The  two  meta  models  are  then  used  to  construct  the 
MBox  using  Castalia,  which  contains  a  graphical  user  interface  module  for  developing  the 
MBox.  The  construction  of  MBox  requires  both  the  knowledge  engineer  for  SPARQL  syntax 
and  the  analyst  to  describe  the  mapping.  Once  the  MBox  is  available,  it  can  be  used  to  develop 
the  situation  specific  Influence  Nets  during  the  Situation  Modeling  phase.  It  should  be  noted  that 
the  Domain  Modeling  phase  is  a  one-time  effort.  Given  a  new  situation  described  using  an  ontol¬ 
ogy  which  can  be  automatically  constructed  using  the  available  text-extraction  ontology  building 
tools,  the  Influence  Net  Generator  module  in  Castalia  automatically  generates  an  Influence  Net 
specialized  for  the  situation.  The  generated  Influence  Net  is  compatible  with  Pythia  and  can  be 
opened  in  Pythia  to  perform  different  kind  of  analyses.  The  Situation  Modeling  phase  is  where 
the  effort  put  in  the  Domain  Modeling  phase  pays  off:  given  a  repository  of  such  domain  models 
in  the  form  of  templates,  situation  models  for  new  problems  can  be  easily  instantiated  by  an  ana¬ 
lyst  by  merely  selecting  a  Template  TIN  and  clicking  a  button  in  Castalia  to  instantiate  it  with 
information  in  an  OWL  ontology.  An  analyst  using  Castalia  does  not  need  to  know  anything 
about  SPARQL,  OWL,  and/or  Protege.  Moreover,  Castalia  also  contains  a  module  for  ontology 
assessment,  which  computes  the  TBox  and  ABox  fitness  measures  during  the  Influence  Net  gen¬ 
eration  process. 


Fig.  4.4  Construction  Process 


4.4  Application 

To  illustrate  the  approach  described  in  this  paper,  a  detailed  investigative  report  [42]  on  the  1998 
bombings  of  the  US  embassies  in  Kenya  and  Tanzania  was  used  to  develop  and  populate  an 
OWL  ontology.  The  class  hierarchy  of  the  ontology  is  shown  in  Fig.  4.5.  The  Template  Ontology 
was  developed  using  the  concepts  derived  from  an  understanding  of  the  general  nature  of  such 
incidents. 
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A  Timed  Influence  Net  model  was  constracted  for  the  Kenya  incident,  using  the  information 
in  the  report,  to  capture  the  events  leading  up  to  the  bombing.  The  Kenya  TIN  model  was  then 
transformed  into  a  Template  TIN  to  represent  a  generalized  model  for  a  terrorist  attack  on  a  US 
interest  abroad.  The  Template  TIN  derived  from  the  Kenya  based  TIN  is  shown  in  Fig.  4.6.  The 
Template  TIN  is  a  collection  of  several  Template  Influences.  The  nodes  in  this  template 
represent  abstract  concepts  derived  by  replacing  instances  from  the  Kenya  TIN  with  the  slot  va¬ 
riables. 


1  SUBCLASS  EXPLORER 

■ _ 

For  Project:  •  TanianiaOntology 

Asserted  Hierarchy 

\\  owl:  Thing  | 

9  AttackMaterials 
9  AttackWeapon 


T  CandidateParticipant 
9  KnownTerroist 
^  LocalCivilian 
^  FinancialSource 
T  9  Location 

9  BombFactory 
T  ^  Observation 

►  0  AdministrationObservation 

►  9  PlanningAndSupportObservation 

►  PostAttackObservation 
9  Terrorist  Attack 

▼  9  Terrorist AttackOperationalPhase 

^  PlanningAndSupport 
^  PostAttack 
9  Surveilliance 

▼  1^  TerroristCell 

•  AttackCell 
9  PlanningCell 


Fig.  4.5  Class  Hierarchy  of  the  Kenya  and  Tanzania  Bombing  Ontology 


Fig.  4.6  Template  TIN  used  in  the  Application 


A  Mapping  Box  (i.e.,  MBox)  was  then  constructed  with  the  help  of  concepts  in  the  Template 
Ontology  (i.e.,  OWL  ontology’s  TBox)  and  in  the  Template  TIN.  The  Following  is  an  example 
of  a  mapping  rule,  expressed  in  SPARQL,  which  provides  a  definition  of  the  relation  between  a 
leader  and  available  funding  as  captured  in  a  Template  Influence.  The  rule  states  that  a  leader  is  a 
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known  terrorist  and  has  a  high  leadership  rank.  It  also  states  that  funding  is  a  fmaneial  souree  and 
a  leader  has  funding. 


SELECT  ?leader  ?funding 

{  ?leader  rdf:type  this:KnownTerroist. 

? leader  this: leader shipRank  ”high”^xsd: string. 

?obsl  rdf: type  this :C2 Observation. 

?obsl  this:hasParticipant  ?leader. 

?funding  rdf '.type  this.'FinancialSource. 

?obs2  rdftype  this:  Financial AcquisitionObservation. 
?obs2  this.'hasFinancialSource  ?funding. 

} 


The  Template  Ontology  was  populated  with  information  in  the  OWL  ontology’s  ABox.  The 
ABox  used  for  this  illustration  contained  data  from  the  Tanzania  bombing  incident  only.  The 
Tanzania  instance  ontology  was  provided  to  Castalia  that  used  it  and  the  MBox  to  generate  a  TIN 
specialized  for  the  Tanzania  incident.  The  construction  of  a  new  instance  TIN  was  automatically 
done  by  Castalia  which  replaced  the  variables  in  each  of  the  Template  Influences  by  the  values 
available  in  the  instance  ontology  with  the  help  of  mapping  rules  in  the  MBox.  Figure  4.7  shows 
the  generated  Timed  Influence  Net.  As  can  be  seen  in  the  generated  TIN,  not  all  variables  were 
instantiated  with  values  from  the  Tanzania  ontology.  For  example,  Castalia  reasoning  engine  did 
not  find  an  instance  for  the  slot  variable  [?trainer]  in  the  Tanzania  data.  In  other  words,  the  data 
available  for  the  Tanzania  incident  had  no  person  identified  as  the  potential  trainer  of  the  bomb¬ 
er.  The  generated  TIN,  however,  succeeded  in  capturing  a  number  of  key  elements,  i.e.,  people 
involved  and  equipment,  used  in  the  bombing. 


Fig.  4.7  Instantiated  Timed  Influence  Net  for  Tanzania  Bombing 

This  generated  TIN  could  be  used  by  a  SME  or  analyst  as  a  fragment  in  a  larger  domain 
model  that  might  require  it  as  part  of  a  more  complex  situation  involving  vehicle  borne  explo¬ 
sives  or  lED  attacks.  The  instantiated  TIN  can  also  be  used  for  course  of  action  analysis  as  well 
as  a  host  of  other  analyses  provided  by  the  TIN  suite  of  tool.  As  mentioned  earlier,  the  templates 
are  not  prescriptions  to  be  used  for  building  future  models,  but  useful  references  that  a 
SME/analyst  might  like  to  consult  either  during  the  process  of  building  a  new  model  or  as  a  start- 
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ing  point  for  it.  The  generated  TIN  can  also  be  used  to  study  temporal  aspects  of  the  influences 
in  the  TIN  and  to  do  a  course  of  action  analysis  indicating  how  long  it  takes  for  input  events  to 
cause  some  desired  or  undesired  effects  on  output  nodes. 

4.5  Conclusion 

Template  TIN  models  a  problem  at  a  generic  level  using  abstract  entities  characterizing  the  prob¬ 
lem  domain,  allowing  an  analyst  to  model  an  entire  class  of  Timed  Influence  Nets  using  a  com¬ 
pact  representation.  However  they  also  lack  specialized  domain  modeling  constructs  like  objects, 
properties,  inheritance  etc.  that  makes  it  difficult  to  construct  and  maintain  probabilistic  models 
for  complex  domains.  This  limitation  of  Influence  Nets  was  overcome  by  using  ontologies, 
which  provide  a  highly  expressive  language  for  representing  complex  domains.  The  presented 
approach  uses  ontologies  along  with  Template  TINs  to  automate  the  Influence  Net  construction 
process.  We  believe  that,  given  the  time  and  expertise  required  for  Influence  Net  construction  by 
hand,  an  automated  approach  for  Influence  Net  construction  would  prove  vital  for  Influence 
Net’s  widespread  adaption  and  use. 

The  mapping  box  used  in  the  approach  acts  as  a  bridge  between  Template  TIN  and  ontolo¬ 
gies,  and  are  expressed  using  SPARQL.  In  the  presented  approach,  an  analyst  will  have  to  ma¬ 
nually  specify  the  MBox.  One  possible  way  to  further  facilitate  an  analyst  would  be  to  automate 
the  MBox  specification  using  automated  inductive  learning  techniques. 

It  is  assumed  that  Castalia  will  benefit  a  growing  community  of  TIN  users  that  include  both 
government  (e.g.,  NASIC,  NFS,  JIEDDO,  AU)  and  private  (e.g.,  Raytheon,  ANSER,  and  other 
corporations  supporting  DOD  and  DHS)  organizations  for  rapid  construction  and  deployment  of 
situational  influence  models  for  intelligence  assessment,  course  of  action  planning  and  assess¬ 
ment  in  EBO,  and  adversarial  modeling  problems.  The  repository  of  Template  Timed  Influence 
Nets  can  also  be  used  for  training  future  analysts  in  different  problem  domains.  The  update  and 
the  re-use  of  the  templates  will  also  facilitate  automated  generation  of  situational  models  for  as¬ 
sessment  and  planning  purposes  in  a  new  theatre  of  operations. 


49 


50 


Chapter  5 


Adversary  Modeling  Applications 

5.1  Modeling  Uncertainty  in  Adversary  Behavior:  Attacks  in  Diyala  Province, 
Iraq,  2003-2006 


Claudio  Cioffi-Revilla  and  Pedro  Romero 


5.1.1  Introduction 

Uncertainty  is  a  universal  characteristic  of  conflict  behavior  and  low-intensity  warfare,  guerrilla, 
insurgency,  and  other  forms  of  violence  that  accompany  civil  war  and  transnational  conflict  seem 
not  to  be  an  exception.  How  can  the  uncertainty  of  adversary  behavior — its  seemingly  haphazard 
nature — ^be  understood  or  grasped  in  order  to  better  prepare  or  mitigate  its  effects?  Which  theo¬ 
retical  principles  and  modeling  tools  might  be  tested  with  available  data?  How  can  empirical 
findings  be  used  to  improve  simulations,  particularly  in  areas  such  as  validation,  verification,  and 
calibration? 

Modeling-based  analyses  can  offer  new  insights  for  analysts  and  policymakers,  and  this 
study  applies  well-established  concepts,  principles,  and  models  from  the  theory  of  political  un¬ 
certainty  and  from  complexity  theory — the  two  core  methodological  approaches  used  in  this 
study — ^to  the  analysis  of  conflict  events  during  the  first  three  years  of  the  second  Iraq  War, 
2003-2006,  in  the  province  of  Diyala.  Preliminary  findings  show  that  neither  the  time  between 
attacks  T  or  the  severity  of  attacks  S  (fatalities)  have  a  “normal”  (i.e.,  bell  shaped  or  Gaussian)  or 
log-normal  distribution  that  is  characteristic  of  equilibrium  systems.  Instead,  both  variables 
showed  “heavy  tails”  in  the  upper  extreme  range,  symptomatic  of  non-equilibrium  dynamics;  in 
some  cases  approximating  a  power  law  with  critical  or  near  critical  exponent  value  of  2.  The 
empirical  hazard  force  analysis  in  both  cases  showed  that  intensity  was  high  for  the  first  epoch  in 
both  variables,  namely  between  March  2003  and  June  2004,  but  even  higher  in  the  following  pe¬ 
riod  ending  in  March  2006.  Moreover,  the  average  empirical  hazard  rate  clearly  increased 
throughout  the  three  epochs,  supporting  the  authors’  hypothesis.  Although  these  findings  are  li¬ 
mited  to  Diyala  province  in  Iraq,  and  do  not  necessarily  apply  anywhere  else  in  the  country  or 
region,  Diyala  province  is  linked  to  several  other  provinces  and  neighboring  Iran — ^via  the  an¬ 
cient  strategic  passage  linking  Khanaqin  (Iraq)  and  Qas,r-e  Shirin  (Iran)  across  the  Zagros  moun¬ 
tains. 

Analysts  and  policymakers  are  always  interested  in  understanding  uncertainty,  and  the  uncer¬ 
tainty  of  warfare  continues  to  dominate  much  of  the  scientific  modeling  literature,  consistent 
with  the  fundamental  nature  of  this  complex  phenomenon.  This  common  interest  should  be  de¬ 
veloped.  In  terms  of  political  uncertainty  theory  applied  to  the  analysis  of  war  [1 13],  [114]  -  that 
is,  the  first  methodological  approach  employed  in  this  study  -  Fearon  [115]  and  others  have  ap¬ 
plied  similar  estimation  techniques  to  model  the  duration  of  civil  wars,  classified  in  five  types, 
arriving  at  two  main  results.  First,  the  “sons  of  soil”  and  contraband-financed  civil  war  types  last 
longer  than  other  types  (coups/popular  revolutions,  anti-colonial  wars,  and  wars  in  eastern  Eu¬ 
rope  or  former  Soviet  Union  countries).  Second,  the  standard  predictors  for  duration  of  civil  wars 
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(e.g.,  ethnic  diversity,  GDP  per  capita,  level  of  democracy,  ideological  effects)  have  a  negligible 
effect  on  war  duration. 

In  the  same  tradition,  Bennett  and  Stam  [116]’  apply  a  parametric  Weibull  regression  to  pre¬ 
dict  the  duration  of  the  ongoing  second  U.S.-Iraq  war.  Based  on  a  set  of  predictor  variables — 
such  as  the  strategies  used  and  the  quality  of  the  terrain,  while  other  factors  (e.g.,  population, 
military  surprise)  are  held  fixed — the  Bennett-Stam  model  predicts  a  likely  duration  of  83 
months,  or  almost  7  years  since  the  fall  of  the  Saddam  Hussein  regime.  However,  it  must  be 
noted  that  such  predictions,  based  on  uncertainty-theoretic  models,  are  probabilistic  expectations, 
not  deterministic  forecasts. 

In  terms  of  complexity  theory  and  power  law  analysis  applied  to  conflict  analysis — the 
second  methodological  approach  used  in  this  study — the  seminal  work  is  by  Richardson  [118], 
[119],  based  on  his  data  set  of  “deadly  quarrels,”  which  included  international  conflicts  and  civil 
wars  between  1820  and  1945.  An  early  revision  of  his  work  and  a  discussion  of  the  different 
theories  behind  his  empirical  work  is  found  in  Rapoport  [120].  Wilkinson  [121]  and  Cioffi- 
Revilla  and  Midlarsky  [122]  present  replications  of  Richardson’s  results  with  larger  and  more 
diverse  data  sets. 

This  chapter  proceeds  as  follows.  Section  5.1.2  presents  the  methods  used  for  data  analysis 
and  model  testing,  based  on  the  theory  of  political  uncertainty  and  social  complexity  theory.  The 
essence  of  these  methods  is  to  use  events  data  as  signals  for  understanding  latent,  underlying  dy¬ 
namics  that  are  causally  responsible  for  observed  conflict.  Although  the  methods  are  statistical, 
mathematical,  and  computational,  they  are  essentially  information  extraction  procedures  for  un¬ 
derstanding  adversary  conflict  dynamics.  The  next  section  presents  the  presents  the  results  in 
technical  and  non-technical  language.  The  fourth  section  presents  a  discussion  of  the  main  results 
and  some  general  conclusions,  including  discussion  of  policy  significance.  The  discussion  of  pol¬ 
icy  implications  is  innovative  for  the  integrated  multidisciplinary  methods  used  in  the  analysis, 
which  combined  political  uncertainty  theory  and  complexity  or  complex  systems  theory. 

5.1.2  Method 

Let  X  denote  a  conflict-related  random  variable,  such  as  the  time-interval  between  attacks  T 
(measured  in  days),  the  severity  S  of  each  attack  (measured  by  fatalities  or  deaths),  distance  D 
from  the  previous  attack,  or  other  variables  associated  with  an  attack  event.  Formally,  a  conflict 
process  P(X<x>)  is  modeled  as  an  n-tuple  of  random  variables  with  realizations  ordered  in  histori¬ 
cal  time  T  (so-called  “epochal  time”  [123]),  where  each  r.v.  is  defined  by  its  set  of  associated 
probability  functions  p(x)  and  <I>(x),  or  p.d.f  and  c.d.f ,  respectively. 

Figure  5.1  illustrates  the  overall  methodological  process  used  in  this  study,  as  detailed  in  the 
following  sections.  Empirically,  our  analysis  is  based  on  2002-2006  high  frequency  (daily)  con¬ 
flict  events  data  collected  independently  at  the  Lawrence  Livermore  National  Laboratory  by  E. 
O’Grady  [124],  [125]  as  detailed  below.  We  conducted  synchronic  analyses  based  on  the  entire 
population  of  data,  as  well  as  diachronic  analyses  based  on  epochs.  In  particular,  we  examined 
results  based  on  the  three  data  “epochs”  proposed  by  the  International  Crisis  Group  (ICG)^, 
based  on  organizational  hypotheses. 


'  Their  model  is  explained  in  detail  in  the  earlier  paper  by  Bennett  and  Stam,  [117] 

2 

International  Crisis  Group  (ICG).  15  February  2006,  available  at  http://www.erisisgroup.org/home/ 
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The  events  data  were  analyzed  with  two  distinct  but  interrelated  types  of  quantitative/  com¬ 
putational  methods:  (i)  hazard  force  analysis,  founded  on  the  theory  of  political  uncertainty  and 
(ii)  power  law  analysis  from  complexity  theory  [126],  Although  traditionally  autonomous  from 
each  another,  in  this  study  we  exploited  the  synergy  of  these  two  analytical  methods  to  obtain 
new  inferences  that  advance  our  understanding  of  adversary  conflict  behavior. 


Fig.  5.1  Overall  events  data  analysis  process  conducted  in  this  study,  starting  with  O’Grady’s 
[124],  [125]  data  on  attacks.  Hazard  force  analysis  and  power  law  analysis  are  parallel  computa¬ 
tional  data  analysis  processes 

5.1.2.1  Data 

This  study  used  the  dataset  Iraq  Event  Database:  Diyala  Province  on  adversary  conflict  events 
recently  compiled  by  O’Grady  (2006),  which  is  based  on  unclassified  sources.  The  data  set  con¬ 
tains  N  =  335  attack  events  that  took  place  in  the  Province  of  Diyala,  Iraq,  between  March  2003 
and  March  2006.  The  two  coded  variables  used  in  this  study  were  “date  of  event”,  used  for  com¬ 
puting  time  between  attacks  (T)  and  “total  fatalities”  (used  as  proxy  for  severity  S),  defined  as 
“the  total  figure  of  people  killed  (includes  terrorist/  insurgent  and  non-terrorist/insurgent).” 
Moreover:  “The  fatalities  count  reports  the  number  killed  in  situ  (in  Diyala),  not  those  that  were 
fatally  injured  and  subsequently  passed  away,  e.g.,  in  a  hospital  in  Europe  or  CONUS  [continen¬ 
tal  United  States].”  These  comprise  military  and  civilian  non-terrorist  plus  terrorist  fatalities. 
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O’Grady’s  new  events  dataset  is  uncommon  and  scientifically  valuable,  because —  inter 
alia — it  provides  a  count  of  high-frequency  daily  events  with  fatalities  (and  other  variables  not 
used  in  this  study).  Most  other  conflict  data  sets  that  record  fatalities  contain  only  low-frequency 
events  (e.g.,  wars).  By  contrast,  most  high-frequency  datasets  (e.g.,  COPDAB,  WEIS,  or  KEDS) 
do  not  report  fatalities.  [127] 

5.1.2.2  Analyses 

As  shown  in  Fig.  5.1  above,  we  analyzed  the  conflict  events  data  using  two  distinct  analytical 
methods,  hazard  force  analysis  and  power  law  analysis,  as  described  in  the  next  subsections. 
Both  methods  were  applied  to  the  same  data  (N  =  335  events)  for  time-between-attacks  T,  and 
severity  S.  In  turn,  each  analysis  was  conducted  synchronically  and  diachronically,  as  explained 
below. 

Temporal  Analyses 

For  each  variable  (time  T  and  severity  S)  and  type  of  analysis  (hazard  force  and  power  law)  we 
first  conducted  an  overall  synchronic  analysis,  based  on  all  the  data  for  the  entire  period  (March 
2003  to  May  2006),  followed  by  a  more  historically  de-  tailed  diachronic  analysis.  The  latter  was 
based  on  three  epochs  of  the  Iraq  conflict  hypothesized  by  the  International  Crisis  Group  (ICG): 

•  “Phase  I”:  March  2003  to  June  2004.  According  to  the  ICG,  this  initial  epoch  was  cha¬ 
racterized  by  “competition”  among  insurgent  groups  that  had  only  erratic  coordination 
and  little  or  no  organizational  capacity.  During  period  I,  Iraqi  rebel  groups  were  small, 
not  very  mobile  and  many  of  the  first  attacks  signaled  a  lack  of  expertise  in  handling 
mortars  or  other  explosive  devices.  Moreover,  they  used  their  small  world  networks  (fam¬ 
ily,  neighbors,  mosques)  to  propagate  by  means  of  leaflets  their  message  of  resistance 
and  recruit  members  or,  in  any  case,  to  foster  similar  initiatives  by  other  people.  Websites 
— such  as  iraqresistance.net — were  used  as  a  channel  to  communicate  the  message  to 
people  outside  their  locality  but  also  outside  Iraq.  This  later  strategy  was  aimed  at  Mus¬ 
lims  willing  to  fight  against  the  coalition  forces. 

•  “Phase  2”:  July  2004  to  June  2005.  During  this  epoch  “consolidation”  would  have  taken 
place  within  groups  of  attackers.  During  this  period,  small  successful  groups  merged  with 
others  and  started  to  apply  more  often  a  strategy  of  hit-  and-run  'a  la  guerrilla  in  order  to 
avoid  frontal  combat.  Also,  an  improvement  regarding  how  to  handle  explosive  devices 
and  the  like  allowed  to  them  to  focus  their  attacks  on  specific  targets. 

•  “Phase  3”:  July  2005  to  May  2006.  This  third  epoch  would  have  been  characterized  by 
the  ICG  as  having  increasing  “confidence” — even  insurgent  optimism —  indicative  of  in¬ 
creased  organizational  capacity  on  the  part  of  attackers.  This  third  period  would  also  have 
been  oriented  towards  justifying  religiously  their  kidnaps  and  killings  of  members  of  the 
U.S.  coalition,  foreign  civilians,  and  even  Iraqis  (mostly  Shi’ites)  working  with  the  coali¬ 
tion. 

The  significance  of  these  three  “phases”  {epochs,  in  quantitative  conflict  analysis  terminolo¬ 
gy)  stems  from  their  application  to  the  overall  conflict  in  Iraq,  applying  to  the  whole  country; 
they  are  not  specific  to  Diyala  province.  The  authors  are  not  aware  of  any  periodization  specific 
to  Diyala.  The  main  theoretical  motivation  for  these  epochs — and  additional  reason  why  epochs 
matter — is  that  conflict  dynamics,  in  terms  of  forces  of  onset  Fj-  and  forces  of  severity  F^,  which 
drive  the  onset  and  severity  of  attacks,  undergo  fundamental  changes  across  epochs  due  to  the 
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increasing  organizational  capacity  of  the  attackers.  Hazard  force  analysis  and  power  law  analysis 
aim  at  detecting  such  latent  forces,  as  described  in  the  next  subsections.  The  ICG  epochs  should 
therefore  mark  significant  transitions  within  an  overall  politico-military  process  affected  by  these 
forces. 

Hazard  Force  Analysis 

The  hazard  force  or  intensity  function  producing  the  observed  realizations  of  a  conflict  process 
P(X<x>)  is  defined  as  follows. 

Definition  5.1  (Intensity  function)  The  intensity  function  H(x)  of  a  c.r.v.  X  is  defined  by  the  ratio 
of  the  value  of  the  p.d.f  to  the  value  of  the  complementary  c.d.f 

of  X.  Formally,  H(x)  is  defined  by  the  equation 


//(x)  = 


p(^) 


(5.1) 


where  p(x)  and  <l>(x)  are  the  p.d.f.  and  c.d.f.  of  X,  respectively. 

Note  that,  although  the  intensity  or  hazard  force  H(x)  is  a  latent  or  non-observable  variable, 
equation  5.1  renders  H(x)  measurable,  because  both  p(x)  and  0(x)  can  be  computed  from  a  suffi¬ 
ciently  large  set  of  observed  realizations  ^ 

Accordingly,  by  (5.1),  the  specific  qualitative  form  of  H(x)  (constant,  in-  creasing,  decreas¬ 
ing,  non-monotonic)  depends  directly  on  the  form  of  the  associated  probability  functions  (c.d.f 
or  p.d.f).  Specifically,  four  cases  are  fundamentally  important  for  analyzing  attacks.  To  illu¬ 
strate,  let  X  =  T,  the  time  interval  between  attacks,  measured — for  instance — in  days. 

Case  1.  Constant  intensity.  H(t)  =  k.  In  this  special  or  equilibrium  case  the  propensity  for  the 
next  attack  to  occur —  i.e.,  the  hazard  rate  or  event  intensity — does  not  change  between  realiza¬ 
tions,  consistent  with  the  notion  that  escalating  and  mitigating  forces  of  conflict  are  in  balance. 
This  also  corresponds  to  the  Poisson  case  and  simple  negative  exponential  density,  with  p(t)  = 
ke”"^'  and  t  =  l/"k  =  a^(t).  This  case  is  known  to  have  the  strongest  empirical  support  for  many 
types  of  conflict,  both  internal  and  international,  following  Richardson’s  [118]  pioneering  work 
on  wars  of  all  magnitudes.  In  terms  of  the  ICG  epochs  mentioned  earlier,  we  expected  to  detect  a 
constant  or  slightly  decreasing  intensity  during  Period  1  (March  2003  to  June  2004),  because  the 
attackers  were  supposed  to  have  been  in  competition  among  themselves  and  attacks  were  erratic. 

Case  2.  Increasing  intensity'.  dH/dt  >  0.  In  this  case  the  hazard  force  or  event  intensity  would  in¬ 
crease  between  attacks,  symptomatic  of  a  fundamentally  unstable  situation  where  attacks  occur 
under  rising  pressure  or  increasing  propensity.  This  situation  is  akin  to  a  driven  threshold  system 
that  triggers  attack  event  as  forces  build  up.  In  terms  of  the  ICG  epochs,  we  expected  to  observe 


3 

The  original  interpretation  of  (5.1)  as  an  intensity  or  force  is  probably  due  to  D.  R.  Cox  [128],  based  on  Bartholo¬ 
mew  [129].  For  a  more  detailed  description  of  hazard  force  analysis,  including  examples  from  conflict  processes  and 
computational  issues,  see  [1 14]  chs.  2-4,  containing  numerous  references.  Unfortunately,  most  of  the  standard  social 
statistical  and  econometric  literature  (e.g.,  Greene  [130])  treats  the  estimation  of  "H  (x)  as  just  another  case  of  re¬ 
gression,  ignoring  the  much  deeper  dynamical  implications  used  in  this  study. 
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increasing  force  intensity  during  Period  2  and  (even  more  so)  in  Period  3,  given  the  rising  orga¬ 
nizational  capacity  of  attackers. 

Case  3.  Decreasing  intensity.  dH/dt  <  0.  In  this  case  the  hazard  force  or  event  intensity  would 
decrease  between  attacks,  symptomatic  of  a  stable  situation  where  at-  tacks  occur  under  dimi¬ 
nishing  pressure  or  decreasing  propensity.  This  situation  is  akin  to  a  leaky  threshold  system  that 
dissipates  forces  as  they  build  up.  For  example,  con-  flict  resolution  mechanisms  (nonviolent 
processes)  may  be  responsible  for  dissipation  and  decreasing  propensity  for  attacks.  In  terms  of 
the  ICG  epochs,  we  expected  to  see  this  force  pattern  only  in  Period  1,  if  at  all. 

The  above  three  cases  are  covered  by  the  two-parameter  Weibull  model: 

H(x)  =  ktP“'  (5.2) 

where  k  and  |3  are  the  scale  and  shape  parameters,  respectively.  Thus,  the  estimated  exponent  "|3 
computed  directly  from  the  data  supports  the  follow  inferences  concerning  the  causal  conflict 
dynamics  driving  the  incidence  of  attacks: 

"P  <  1  :  decreasing  conflict  force )  stable  situation  (5.3) 

"P  =  1  :  constant  conflict  force  )  borderline  situation  (5.4) 

"P  >  1  :  increasing  conflict  force )  unstable  situation  (5.5) 

Clearly,  these  three  conflict  situations  are  qualitatively  distinct,  and  from  a  policy  perspective 
they  obviously  correspond  to  desirable,  indifferent,  and  undesirable  conditions,  respectively.  In¬ 
terestingly,  the  mean  or  first  moment  of  T  is  given  by 

“t  =  kr(l  +  l/p)  (5.6) 

where  T  is  the  gamma  function.  Therefore,  commonly  used  heuristic  estimates  based  of  mean 
values  (e.g.,  “the  average  time  lapsed  between  attacks”)  are  not  generally  valid  and  instead  must 
be  computed  exactly  because  t  is  notoriously  sensitive  to  "P 

Finally,  a  fourth  qualitative  case  in  the  qualitative  form  of  the  conflict  force  is  also  interest¬ 
ing: 

Case  4.  Non-monotonic  intensity.  After  an  attack  occurs,  the  conflict  force  may  rise  (as  in  Case 
2),  but  then  subside,  as  in  a  lognormal  function.  Alternatively,  the  conflict  force  may  subside  fol¬ 
lowing  an  attack  and  then  begin  to  rise  again  sometime  after,  as  in  a  so-called  “bathtub”  function. 
These  non-monotonic  situations  were  also  considered  in  our  analysis,  given  their  plausibility.  In 
terms  of  the  ICG  epochs,  their  logic  seemed  mostly  linear,  ruling  out  non-monotonic  forces. 

Summarizing  our  hazard  force  analysis,  conflict  events  data  on  time  intervals  between  at¬ 
tacks  (T)  and  fatalities  produced  by  each  attack  (or  severity  S)  were  used  to  compute  the  corres¬ 
ponding  empirical  hazard  functions,  H(t)  and  H(s),  respectively.  These  empirical  functions  were 
then  closely  examined  to  determine  their  qualitative  shape  and  draw  inferences  concerning  con¬ 
flict  conditions.  This  procedure  was  repeated  for  the  entire  population  of  data,  as  well  as  for  each 
of  the  three  ICG  epochs.  The  initial  expectation  was  that  these  estimates  would  yield  mostly 
Case  1  (constant  force),  consistent  with  many  earlier  studies,  with  rising  value  of  k  as  the  epochs 
progressed  (as  argued  by  the  ICG). 
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Power  Law  Analysis 

Power  law  analysis  is  a  complexity-theoretic  method  for  drawing  inferences  from  a  set  of  con¬ 
flict  data.  Here  we  used  the  so-called  type  IV  power  law,  which  is  defined  as  follows."^ 


Definition  5.2  (Power  law)  A  power  law  of  a  conflict  process  P(X<f>)  is  a  parametric  distribu¬ 
tion  model  where  increasing  values  x,  e  X  of  the  conflict  variable  X  occur  with  decreasing  fre¬ 
quency,  or  f(x)  / X  with  b>  0.  Formally,  f(x)  in  this  case  is  a p.df  given  by  (5.7)  where  a  and 
b  are  scale  and  shape  parameters,  respectively. 


p(j:}  = 


a(b-l} 


(5.7) 


From  this  2-parameter  hyperbolic  equation  for  the  p.d.f  it  can  be  easily  shown  that  the  com¬ 
plementary  cumulative  density  function  (c.c.d.f),  defined  as  1  -  <l>(x)  =  Pr(X  >  x)  (a.k.a.  survival 
function  when  X  =  T,  or  S(x)),  has  the  following  form  in  log-log  space: 


|log[l  -  ^{t)]  =  a  -{h-  1)  log: 
which,  finally,  yields 


(5.8) 


(5.9) 


The  penultimate  expression  is  commonly  used  for  empirical  analysis,  because  it  can  be  ob¬ 
tained  directly  from  the  set  of  observed  values  "xi. 


The  empirical  estimate  "b  is  of  interest  because  the  first  moment  of  a  power  law  is  given  by 

(5.10) 


^(a;}  =  f  j;p(x}(ir  =  a(if  —  1)  f  ^dx 


2-b  ^ 


DO 


inia{z} 


which  goes  to  infinity  as  b  goes  to  2.  In  other  words,  there  is  no  mean  size  (no  expected  value 
E(x)  exists)  for  the  conflict  variable  X  (such  as  onset  times  T  or  severity  S)  when  X  is  governed 
by  a  power  law  with  exponent  b  approaching  the  critical  value  of  2,  or  (b  -  1)  <  1  (below  unit 
elasticity).  This  is  an  insightful  theoretical  result  for  numerous  social  variables,  such  as  organiza¬ 
tional  sizes,  fatalities  in  warfare  [118],  [122]  and  terrorist  attacks.  The  critical  threshold  b  =  2 
marks  the  dynamical  boundary  between  conflict  regimes  that  have  a  finite  average  and  computa¬ 
ble  size  (b  >  2)  and  a  highly  volatile  regime  that  lacks  an  expected  value  or  mean  size  (b  <  2). 
This  is  a  theoretical  insight  directly  derived  from  the  empirically  estimated  value  of  the  power 
law  exponent  b. 


4 

Other  types  of  power  laws  include  the  rank-size  law  or  Zipfian,  various  algebraic  forms,  and  others  [131].  In  this 
study  we  applied  the  type  IV  power  law  because  in  the  case  of  conflict  data  (attacks)  it  seems  to  provide  the  most 
powerful  complexity-theoretic  inferences. 
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Based  on  previous  studies,  we  expected  that  (a)  T  should  obey  the  simple  (one  parameter) 
negative  exponential  p.d.f.  of  a  Poisson  process, 

p(t)  =  ?ie'^'  (5.11) 

where  'X  =  1/1;  and  (b)  S  should  obey  a  power  law.  Moreover,  with  respect  to  the  diachronic 
epochs  (ICG  periods)  discussed  earlier,  we  expected  t  to  increase  across  periods  (epochal  time) 
and  "b  to  approach  criticality  as  the  attackers  gained  strength. 

Summarizing  our  power  law  analysis,  conflict  events  data  on  time  interval  between  attacks 
(T)  and  the  severity  of  attacks  (S)  were  used  to  compute  the  corresponding  empirical  power  law 
functions  log[l  -  <I>(t)]  and  log[l  -  <l>(s)],  for  onsets  and  severity  (fatalities),  respectively.  These 
empirical  functions  were  then  closely  examined  to  determine  their  qualitative  shape  and  draw 
inferences  concerning  conflict  conditions.  We  also  examined  the  p.d.f  s  directly  using  kernel  es¬ 
timation.  This  procedure  was  repeated  for  the  entire  population  of  data  (synchronic  analysis),  as 
well  as  for  each  ICG  epoch  (diachronic).  The  initial  expectation  was  that  these  estimates  would 
yield  mostly  a  poor  fit  of  the  power  law  for  the  overall  synchronic  analysis,  but  increasingly 
good  fit  and  decreasing  exponent  (towards  criticality)  as  the  epochs  progressed  and  the  attackers 
became  more  organized. 

5.1.3  Findings 

First  are  presented  the  temporal  findings  for  the  analysis  of  time  between  attacks  T  (the  next  sub¬ 
section),  including  both  synchronic  and  diachronic  patterns,  followed  by  a  parallel  presentation 
of  findings  for  the  severity  of  attacks  S  (the  subsection  after).  Table  5.1  summarizes  the  overall 
descriptive  statistics  for  both  processes,  T  and  S. 

Time  Between  Atttacks 

Overall  (Synchronic)  Patterns.  There  were  107  occurrences  were  T  =  0,  meaning  more  than  one 
attack  took  place  in  a  given  day.  The  large  and  positive  skewness  implies  that  the  right  tail  of  the 
distribution  is  more  pronounced.  Kurtosis  is  substantially  larger  than  zero,  implying  a  leptokurtic 
feature.  These  moments  suggests  a  distribution  for  T  with  non-normal  characteristics. 

Another  insightful  indicator  is  the  ratio  of  the  mean  to  the  standard  deviation,  which  in  this 
case  is  0.37  and  closer  to  0  than  to  1.  This  could  imply  a  hyper-exponential  process  or  a  high  de¬ 
gree  of  political  uncertainty,  because  the  mean  of  T  is  significantly  smaller  than  the  variance  (by 
a  factor  of  24). 

Figures  5.2  and  5.3  plot  the  empirical  c.d.f  and  p.d.f,  respectively,  consistent  with  the  non¬ 
normal  results  reported  in  Table  5.1. 

TABLE  5.1  Onset  of  attacks  T  (days  between  events) 


Descriptive  Statistics:  Wliole  Sample 

Mean 

Variance 

Skewness 

Kurtosis 

Mode 

3.25 

78.15 

8,13 

80.65 

0 

Std.  Dev 

Median 

Max 

Min 

N 

8.84 

1 

104 

0 

334 
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Fig.  5.2  Cumulative  probability  density  for  time  between  attacks  T,  Diyala  Province,  Iraq. 

March,  2003  -  March,  2006 
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Fig.  5.3  Probability  density  for  time  between  attacks  T,  Diyala  Province,  Iraq.  March,  2003  - 

March,  2006 

Both  graphs  suggest  a  distribution  with  a  pronounced  exponential  pattern.  Note  also  that  by 
the  10th  day  the  c.d.f.  amounts  to  95%,  implying  that  short  intervals  between  attacks  are  by  far 
the  most  frequent.  In  other  words,  following  an  attack  the  probability  of  another  attack  is  very 
high  within  intervals  no  greater  than  10  days.  The  surprisability  of  the  process,  or  difference  be¬ 
tween  the  mean  and  the  median,  yielded  2.3  days,  which  is  another  indication  of  the  volatility  of 
attacks. 

Normality  Tests.  The  results  in  Table  5.1,  showing  that  the  mean  of  3.25  days  is  clearly  lower 
than  the  standard  deviation  of  8.84  days,  as  well  as  the  empirical  distributions  in  Figures  2  and  3, 
consistently  imply  that  the  data  might  not  be  normally  distributed.  A  formal  test  of  normality  was 
applied  to  corroborate  these  preliminary  results.  The  Shapiro-Wilk  test  was  implemented  to  test 
the  null  hypothesis  that  the  data  are  normally  distributed  and  the  results  are  reported  in  Table  5.2. 
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We  also  tested  the  hypothesis  of  a  lognormal  distribution,  by  computing  the  log-transformation 
of  T.  Because  the  p- value  is  less  than  5%  the  null  hypothesis  is  rejected  in  both  cases. 

In  addition,  the  variable  T  does  not  correspond  to  a  lognormal  distribution  either.  In  both 
cases  the  probability  or  p- value  is  very  small  or  close  to  zero. 

TABLE  5.2  Shapiro-Wilk  Test 


Time  Between  Events 

Variable 

Obs 

W 

V 

z 

p- value  >z 

T 

334 

0.3571 

1-50.07 

11.83 

0.0000 

Ln(T) 

227 

0.942.5 

9.56 

5.23 

0.0000 

Hazard  Forces.  We  applied  the  Kaplan-Meier  method  for  estimating  the  empirical  survival 
function  "  S(t),  and  results  are  shown  in  Figure  5.4.  Recall  that  the  K-M  method  is  non- 
parametric,  so  it  does  not  impose  a  specific  structure  on  the  data.  In  this  case  the  estimated  value 
of  the  probability  of  no  attack  within  time  t  should  be  interpreted  as  the  product  of  the  probabili¬ 
ties  of  not  attack  occurring  at  t  and  the  preceding  periods.  In  our  particular  case  the  K-M  estima¬ 
tor  tell  us  that  the  survival  function  for  attacks  drops  off  sharply  in  the  days  following  an  attack 
and  slowly  settling  to  zero  after  about  10  days. 


KAPLAN -MBER  ESTIMATE 


Fig.  5.4  Empirical  survival  function "  S(t),  for  time  between  attacks  T,  Kaplan-Meier  estimate, 
Diyala  Province,  Iraq.  March,  2003  -  March,  2006 


Figure  5.5  shows  the  K-M  estimate  of  the  hazard  force  function.  In  terms  of  the  WeibuII  ha¬ 
zard  model  given  by  (5.2),  Figure  5.5  implies  that  "P  <  1.  Specifically,  this  empirical  hazard 
force  for  the  complete  period  is  decreasing  until  approximately  the  10th  day,  after  which  it  shows 
some  volatility  around  a  value  of  0.1.  The  average  empirical  hazard  force  is  0.0877,  a  value  that 
will  be  more  meaningful  when  we  analyze  the  data  within  shorter  periods  (epochal,  diachronic 
analysis). 
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EMPIRICAL  HAZARD  RATE 


Time  Between  Events 


Fig.  5.5  Diyala  Province,  Iraq.  March,  2003  -  March,  2006 

Power  Laws  and  Criticality.  Our  alternative  hypothesis,  given  the  rejection  of  the  normality 
(or  log-normal  characteristics)  of  the  data,  is  that  the  data  follow  a  power  law  as  defined  earlier 
in  the  methodological  section.  A  univariate  regression  model  was  carried  out,  in  order  to  test  the 
linearized  power  law  using  an  ordinary  least  squares  (OLS)  procedure.  The  logarithmic  trans¬ 
formation  was  applied  to  the  complementary  c.d.f  (or  survival  function)  and  T,  as  described  ear¬ 
lier  in  the  Methods  section. 

Figure  5.6  shows  the  scatter  plot  for  both  variables,  the  linear  regression  fit,  and  a  95%  con¬ 
fident  interval.  Both  point  estimates,  also  inserted  in  the  figure,  are  statistically  significant  at  the 
1%  level.  The  slope  estimate  is  the  most  relevant  in  this  type  of  analysis,  which  is  minus  1.03. 
The  R  is  0.95  and  the  standard  errors  for  the  constant  term  and  the  slope  are  0.0085  and  0.0153, 
respectively.  Although  the  overall  fit  is  close,  there  is  clearly  some  systematic  departure  in  the 
pattern  for  the  upper  range. 


POWER  LAW 


Y-  -□.19  -  1  inx 


Fig.  5.6  The  empirical  complementary  c.d.f  for  time  between  attacks  T  in  log-log  space,  Diyala 

Province,  Iraq.  March,  2003  -  March,  2006 
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Epochal  (Diachronic)  Patterns.  The  null  hypothesis  tested  was  that  the  estimates  for  the  ha¬ 
zard  force  would  yield  a  roughly  constant  intensity  within  each  epoch  with  increasing  average 
mean  values  for  the  hazard  force  across  epochs.  Figures  7  through  9  plot  the  empirical  hazard 
force  functions  for  the  three  epochs. 

The  pattern  in  Figure  5.7  is  not  clear-cut  or  smooth  because  there  are  fluctuations  starting  at 
zero  up  to  0.2  for  the  first  forty  days,  then  the  hazard  rate  drops  to  zero  until  day  95th  where  it 
spikes  up  to  0.45.  The  average  empirical  hazard  rate  for  Period  1  is  0.094.  Also,  after  the  twen¬ 
tieth  day  the  pattern  is  not  very  different  from  Figure  5.5,  including  even  the  sudden  spike 
around  day  95th. 


EMPIRICAL  HAZARD  RATE 


Time  Between  Eients 


Fig.  5.7  Diyala  Province,  Iraq.  Period  1,  March,  2003  -  June,  2004.  Source:  Prepared  by  the  au¬ 
thors  based  on  O’ Grady’s  (2006a,  2006b) 


TABLE  5.3  Severity  of  attacks  S  (fatalities  data  were  either  normally  distributed  or  belonged  to  a 

lognormal  distribution) 


Descriptive  statistics  whole  sample 

Mean 

Variance 

Skewness 

Kurtosis 

Mode 

4.17 

74.0 

S.19 

32.66 

1 

Std.  Dev 

Median 

Max 

Mm 

N 

3.6 

2 

71 

0 

33S 

In  Figure  5.8  for  Period  2  we  observe  a  different  pattern  from  the  one  in  Period  1. 
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Fig.  5.8  Diyala  Province,  Iraq.  Period  2,  July,  2004  -  June,  2005.  Source:  Prepared  by  the  au¬ 
thors  based  on  O’ Grady’s  (2006a,  2006b) 

However,  before  the  twentieth  day  the  empirical  hazard  rate  for  Period  2  is  not  very  different 
from  the  pattern  for  the  empirical  hazard  rate  within  the  whole  period  (see  synchronic  results  ear¬ 
lier).  That  is  to  say,  in  Period  2  the  hazard  rate  decreases  during  the  first  twenty  days  and  then 
spikes  up  beyond  0.5.  This  last  fluctuation  of  the  data,  however,  might  be  an  artifact  of  the  com¬ 
putation  of  the  data  rather  than  a  reflection  of  the  actual  intensity  of  the  events.  The  average  em¬ 
pirical  hazard  rate  for  Period  2  is  0.212,  not  counting  the  last  point  beyond  0.7.  This  is  twice  as 
high  as  the  average  hazard  rate  for  Period  1 .  Therefore,  during  this  period  from  June,  2004  until 
June,  2005,  there  was  a  doubling  in  the  hazard  force  driving  attacks  in  Diyala  province.  There  is 
no  such  a  drastic  difference  between  the  plot  in  Figure  5.8  and  the  one  for  Period  3  in  Figure  5.9, 
which  spans  the  period  from  summer  2005  until  March,  2006.  The  average  empirical  hazard  rate 
in  Period  3  was  0.217,  not  including  the  last  point  above  0.8.  Thus,  during  this  epoch  there  was 
not  a  substantial  increase  in  relation  to  what  happened  in  Period  2. 

EMPIRICAL  HAZARD  RATE 


Time  Belween  Events 


Fig.  5.9  Diyala  Province,  Iraq.  Period  3,  July,  2005  -  March,  2006 
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All  in  all,  the  analysis  of  Diyala  attacks  by  epochs  is  consistent  with  the  increased  organiza¬ 
tional  capacity  hypothesized  by  the  ICG  in  terms  of  an  increase  in  the  average  empirical  hazard 
forces. 

Power  Laws.  Figures  5.10  through  5.12  report  the  results  of  the  diachronic  power  law  analy¬ 
sis  for  individual  epochs. 

Figure  5.10  for  the  first  epoch  shows  a  linear  regression  OLS  slope  estimate  of  -0.62,  which 
is  statistically  significant  at  1%  level  of  confidence.  The  standard  errors  reported  for  the  constant 
and  the  slope  terms  are  low:  0.0374  and  0.0399,  respectively,  with  =  0.9.  Figure  5.11  shows 
results  for  the  second  epoch,  with  a  steeper  slope  estimate  of  -1.15,  also  statistically  significant  at 
1%  level  of  confidence.  The  respective  standard  errors  reported  for  both  regression  terms  are: 
0.0179  and  0.0366,  =  0.9.  Figure  5.12  shows  the  slope  estimate  to  be  -1.25,  again  statistically 

significant  at  1%  level  of  confidence.  The  standard  errors  are  0.0174  and  0.0406,  respectively, 
with  R^  =  0.92.  Note  that  the  slope  becomes  increasingly  steeper. 
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Fig.  5.10  Diyala  Province,  Iraq.  Period  1,  March,  2003  -  June,  2004 


In  general,  the  power  law  for  the  whole  period  is  the  closest  to  a  linear  relationship  between 
the  complementary  c.d.f.  and  T.  However,  all  periods  show  some  upper  range  bending,  even  if 
slight  in  some  cases.  We  cannot  make  a  formal  test  to  determine  if  the  slope  coefficients  for 
every  linear  regression  are  equal  because  of  the  difference  in  the  number  of  observations. 
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Fig.  5.11  Diyala  Province,  Iraq.  Period  2,  July,  2004  -  June,  2005 
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Fig.  5.12  Diyala  Province,  Iraq.  Period  3,  July,  2005  -  March,  2006 
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Severity  of  Attacks 

Overall  (Synchronic)  Patterns.  Table  5.3  shows  a  summary  of  the  descriptive  statistics  for  the 
severity  S  of  attacks.  The  statistical  properties  for  S  are  not  very  different  from  those  discussed 
earlier  for  the  time  between  events  (T).  We  observe  positive  skewness  and  kurtosis,  again  mean¬ 
ing  that  we  should  find  a  pronounced  right  tail  and  leptokurtic  distribution.  The  ratio  between  the 
mean  and  the  standard  deviation  is  0.485  which  also  suggests  a  non-normal  pattern.  The  mode  is 
1  and  the  median  is  2.  That  is  to  say,  the  most  typical  number  of  fatalities  produced  by  an  attack 
was  one  death. 

The  empirical  c.d.f  and  p.d.f.  are  plotted  in  Figs.  5.13  and  5.14  ,  respectively.  We  observe 
the  similarity  with  the  respective  figures  for  T.  The  pronounced  right  tail  with  a  few  values  at  the 
end  of  the  distribution,  or  “dragon  tail”  indicating  the  presence  of  extreme  events  with  unduly 
high  frequency/probability. 
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Fig.  5.13  Diyala  Province,  Iraq.  March,  2003  -  March,  2006 
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Fig.  5.14  Diyala  Province,  Iraq.  March,  2003  -  March,  2006 
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Normality  Tests.  Table  5.4  shows  the  results  of  our  Shapiro-Wilk  test  for  the  normality  of  attack 
severity  S  (fatalities).  As  before,  the  null  hypotheses  were  that  the  data  were  either  normally  dis¬ 
tributed  or  belonged  to  a  lognormal  distribution. 

Because  both  p-values  are  less  than  5%,  or  even  1%,  the  null  hypothesis  can  be  rejected  in 
both  tests.  These  results  provide  more  confident  about  our  previous  claim  that  the  data  for  severi¬ 
ty  S  is  not  normally  distributed  or  even  belong  to  a  lognormal  distribution.  This  provides  addi¬ 
tional  justification  for  the  power  law  analysis. 


TABLE  5.4  Shapiro-Wilk  Test 


Severity  of  attacks  S  (fatalities) 

Variable 

Ubs 

W 

V 

Z 

p-value>z 

Fatalities 

311 

0.4846 

113.37 

11.12 

0.0000 

Lri(  Fatalities) 

241 

0.9571 

7.54 

4.69 

0.0000 

Hazard  Forces.  Figures  5.15  and  5.16  show  the  K-M  estimate  for  the  c.c.d.f  and  the  hazard 
force,  respectively.  The  K-M  estimate  for  the  c.c.d.f  for  severity  S  reflects  the  cumulative  prob¬ 
ability  of  an  additional  fatality  beyond  a  given  level  s.  For  the  whole  period,  that  probability  is 
less  than  0.25  beyond  the  first  five  fatalities  and  it  decreases  faster  than  the  Kaplan-Meier  curve 
for  the  variable  time  between  events  T.  Beyond  S  =  20  deaths  the  probability  is  very  close  to  ze¬ 
ro,  although  the  hazard  force  highlights  the  probability  of  extreme  events. 


KAPLAN-MEIER  ESTIMATE 


Fig.  5.15  Empirical  complementary  cumulative  probability  function  for  severity  of  attacks  S  (fa¬ 
talities),  Kaplan-Meier  estimate,  Diyala  Province,  Iraq.  March,  2003  -  March,  2006 
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EMPIRICAL  HAZARD  RATE 


Fig.  5.16  Diyala  Province,  Iraq.  March,  2003  -  March,  2006 

The  empirical  hazard  rate  for  severity  S,  shown  in  Figure  5.16,  starts  off  at  a  value  close  to 
0.4  and  decreases  steadily  by  the  twentieth  day,  after  which  it  fluctuates  around  0.1.  The  average 
empirical  hazard  rate  for  the  whole  period  is  0.1472.  These  results  have  added  uncertainty,  be¬ 
cause  in  this  series  there  are  24  events  with  missing  data.  In  general,  the  intensity  in  fatalities  de¬ 
creases  in  Diyala  up  to  a  value  of  around  20  twenty,  after  which  it  fluctuates  with  spikes  around 
50  and  65 — ^not  exactly  well-behaved.  Power  Laws  and  Criticality  Figure  5.17  shows  the  plot  of 
the  empirical  c.c.d.f.  of  S  in  log-log  space,  including  the  observed  data  points,  the  best-fitting 
OLS  line,  and  95%  confidence  intervals. 
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Fig.  5.17  Empirical  c.c.d.f  of  severity  S  (fatalities)  in  log-log  space,  Diyala  Province,  Iraq. 

March,  2003  -  March,  2006 
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The  linear  regression  fitted  curve  through  the  OLS  approach  yields  a  slope  estimate  of -0.94, 
which  is  statistically  significant  at  the  1%  level  of  confidence.  Unfortunately,  once  again,  the  up¬ 
per  range  falls  off  exponentially.  Nonetheless,  the  standard  errors  reported  are:  0.0098  and 
0.0158  for  the  constant  and  slope  coefficients,  respectively;  and  the  is  0.94.  Overall,  while  the 
data  are  not  normally-distributed,  they  also  fall  short  of  a  perfect  fit  to  a  power  law,  indicating 
perhaps  another  fat-tailed  distribution. 

Epochal  (Diachronic)  Patterns.  In  Figures  5.18,  5.19,  and  5.20  we  report  results  the  three 
epochs,  in  a  similar  way  as  for  time  between  attacks  (T).  We  observe  a  generally  decreasing  and 
fluctuating  pattern  from  approximately  0.4  to  0  in  Period  1  (without  taking  into  account  the  last 
computed  value  that  climbs  to  almost  1  due  to  rounding  errors).  The  average  in  this  first  epoch 
was  0.3737  (omitting  the  last  point).  This  pattern  is  quite  different  from  the  empirical  hazard  rate 
for  the  complete  period  in  Diyala,  but  it  could  be  due  to  fewer  observations.  On  the  other  hand,  a 
similar  pattern  in  Period  2  to  the  empirical  hazard  rate  of  the  whole  series  is  observed  in  Figure 
5.16.  Its  average  hazard  rate  was  0.1719,  again  higher  than  the  value  for  the  whole  series.  And 
lastly,  in  Period  3  the  average  hazard  rate  is  0.1852,  slightly  higher  than  in  the  second  epoch. 
Therefore,  the  average  hazard  force  for  severity  S  (fatalities)  dropped  substantially  from  Period  1 
to  Period  2,  but  then  increased  slightly  in  Period  3 — a  pattern  not  consistent  with  the  organiza¬ 
tional  dynamics  hypothesized  by  the  ICG.  This  pattern  in  overall  force  mitigation  may  have  been 
due  to  increased  effectiveness  of  the  coalition  forces  in  Periods  2  and  3  relative  to  Period  1 . 


EMPIRICAL  HAZARD  RATE 


Fig.  5.18  Diyala  Province,  Iraq.  Period  1,  March,  2003  -  June,  2004 
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EMPIRICAL  HAZARD  RATE 


Fig.  5.19  Diyala  Province,  Iraq.  Period  2,  July,  2004  -  June,  2005 


EMPIRICAL  HAZARD  RATE 


Fig.  5.20  Diyala  Province,  Iraq.  Period  3,  July,  2005  -  March,  2006 


Power  Laws  and  Criticality.  Figure  5.21  shows  the  results  for  the  power  law  analysis  in  Period  1 : 
the  slope  estimate  is  -1.15,  which  is  statistically  significant  at  the  1%  level  of  confidence.  Stan¬ 
dard  errors  reported  for  the  constant  and  slope  coefficients  are:  0.0427  and  0.0895,  respectively; 
and  the  is  0.88.  In  Fig.  5.22  for  Period  2  the  slope  estimate  is  -0.95,  also  statistically  signifi¬ 
cant  at  1%  level  of  confidence.  Standard  errors  reported  for  the  constant  and  slope  coefficients 
are:  0.0108  and  0.0185,  respectively;  and  the  is  0.96.  In  Figure  5.23  the  slope  came  to  -0.85, 


70 


again  statistically  significant  at  1%  level  of  confidence,  standard  errors  for  the  constant  and  slope 
were  0.0198  and  0.0299,  respectively,  and  the  is  0.9.  In  general.  Periods  1  and  2  clearly  show 
the  best  fits  to  a  power  law,  although  here  again  the  very  highest  values  tend  to  deviate.  Thus, 
these  two  epochs  might  be  reflecting  a  similar  evolution  to  the  one  observed  for  the  complete 
period  previously.  It  is  not  feasible  to  make  a  formal  test  to  compare  the  slope  coefficients  across 
epochs  and  the  whole  period  due  to  the  difference  in  the  number  of  observations,  however,  they 
indicate  a  general  movement  toward  a  flatter  and  hence  more  lethal  extreme  range. 
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Fig.  5.21  Diyala  Province,  Iraq.  March,  2003  -  June,  2004 
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Fig.  5.22  Diyala  Province,  Iraq.  July,  2004  -  June,  2005 
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Fig.  5.23  Diyala  Province,  Iraq.  July,  2005  -  March,  2006 


5.1.4  Discussion 

The  findings  reported  in  this  article  suggest  new  insights  and  implications  for  research  and  poli¬ 
cy.  The  utility  of  these  findings  is  to  illuminate  the  political  and  military  context  of  conflict,  and 
to  address  the  questions  raised  in  the  introduction.  The  following  discussion  focuses  on  the  main 
findings  and  selected  policy  implications. 

Main  Empirical  Findings 

The  results  for  the  onset  of  attacks  T  (time  between  events)  in  the  analysis  of  overall  synchronic 
patterns  showed  a  non-normal  distribution  with  a  heavy  right  tail.  The  formal  normality  tests 
(Shapiro-Wilk)  also  rejected  the  null  hypothesis  for  the  presence  of  a  lognormal  distribution  in 
the  data.  The  empirical  c.d.f  and  p.d.f  both  allow  one  to  visualize  this  non-normal  pattern  in  the 
distribution  of  T  .  These  statistical  properties  suggest  a  high  degree  of  political  uncertainty,  far 
from  the  equilibrium  conditions  of  normality  with  marked  central  tendency.  The  Kaplan-Meier 
estimate  of  the  survival  function  'S{t )  demonstrated  that  T  has  a  higher  probability  of  realizing 
very  short  time  spans  between  attacks,  with  rapidly  increasing  cumulative  probability  (much 
faster  than  Poisson).  In  addition,  the  empirical  hazard  force  function  showed  that  the  intensity  of 
the  force  for  attacks  to  take  place  decreased  up  to  approximately  the  tenth  day,  after  which  this 
intensity  fluctuated  below  0.1.  The  average  hazard  rate  for  the  complete  period  was  0.088  at- 
tacks/day,  but  varied  across  epochs. 

The  power  law  analysis  of  onset  times  T  yielded  a  point  estimate  for  the  slope  of  the  inverse 
relationship  between  the  c. c.d.f.  and  T  of  1.03,  with  a  statistically  significant  1%  chance  of  being 
wrong.  This  is  basically  a  perfect  inverse  relation  between  these  two  logarithmic  variables.  More 
importantly,  the  exponent  is  therefore  2.03,  which  is  critical  given  the  usual  level  of  imprecision 
in  these  data.  The  complexity-theoretic  implication  of  this  finding  is  that,  for  the  overall  period. 
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extreme  time  spans  are  far  more  likely  than  would  be  normally  assumed,  and  (by  Equation  5.12) 
the  first  moment  is  practically  nonexistent  from  a  theoretical  perspective. 

For  the  epochal  diachronic  patterns  the  authors  found  that  for  the  first  epoch  of  T  the  empiri¬ 
cal  hazard  rate  did  not  evolve  in  a  clear-cut  fashion,  fluctuating  basically  around  0.1  until  the  for¬ 
tieth  day  and  going  to  zero  thereafter.  During  Period  1  the  average  empirical  hazard  rate  was 
0.094,  which  is  close  to  the  level  for  the  overall  period.  For  the  second  and  third  epochs,  howev¬ 
er,  this  average  increased  to  around  0.21,  which  is  at  least  twice  as  the  early  period.  In  both 
epochs  the  hazard  rates  were  decreasing  until  the  twentieth  day.  In  terms  of  the  initial  hypothes¬ 
es,  these  results  are  generally  supportive. 

All  the  slope  estimates  of  the  power  law  analyses  of  T  for  the  three  epochs  were  statistically 
significant  at  the  1%  level  of  confidence,  with  high  values  of  and — more  importantly — very 
small  standard  errors.  For  the  first  epoch  the  slope  estimate  was  -0.62,  which  is  critical,  -1.15 
for  the  second  epoch,  and  -1.25,  or  away  from  criticality  for  the  third  and  last  epoch.  However, 
the  authors  also  note  the  occurrence  of  systematic  deviations  of  the  highest  values,  down  from 
the  theoretically  expected  fit  of  the  power  law.  Most  likely,  the  upper  tail  for  the  distribution  of  T 
was  exponential,  consistent  with  earlier  literature,  not  power  law. 

Results  for  the  severity  of  attacks  S  (fatalities)  also  resemble  in  some  ways  the  nonnormality 
characteristics  of  T  for  the  analysis  of  overall  synchronic  patterns.  Severity  showed  a  pro¬ 
nounced  right  tail  according  to  its  skewness  (5.19)  and  the  empirical  p.d.f.  plot  confirmed  such  a 
pattern.  The  mode  of  severity  was  one  casualty  per  attack  in  Diyala.  Furthermore,  according  to 
the  Shapiro- Wilk  test  the  statistical  distribution  of  S  did  not  belong  either  to  a  normal  or  log¬ 
normal  distribution,  which  is  also  consistent  with  the  fat  tail.  A  Kaplan-Meier  estimate  con¬ 
structed  for  S  also  showed  an  overall  similar  pattern  as  that  found  for  T  .  However,  in  this  case 
the  c.c.d.f  decreased  even  faster  and  was  less  than  25%  after  the  first  five  fatalities.  The  corres¬ 
ponding  empirical  hazard  force  of  S  for  the  whole  period  started  at  0.4  and  decreased  steadily 
until  about  the  twentieth  day,  after  which  it  fluctuated  below  0.1  with  an  average  value  of 
0.1472. 

The  power  law  analysis  of  S  for  the  whole  period  yielded  a  slope  estimate  of  -0.94,  which 
was  also  statistically  significant  at  1%  level  of  confidence  with  a  high  value  of  0.94.  This 
demonstrated  an  almost  perfect  inverse  relationship  between  the  c.c.d.f  and  S.  The  epochal  di¬ 
achronic  patterns  for  the  three  epochs  of  S  showed  a  decreasing  and  fluctuating  pattern  from  0.4 
to  zero  in  Period  1 .  This  pattern  was  different  from  the  empirical  hazard  rate  for  the  complete 
period  in  Diyala.  However,  a  similar  development  in  Period  2  to  the  empirical  hazard  force  of  the 
whole  series  was  observed  in  the  middle  panel  of  Table  4.  And,  lastly,  Period  3  also  showed  a 
somewhat  similar  process  to  Period  2  but  with  higher  values  at  points  close  to  40  fatalities.  All  in 
all,  the  respective  averages  in  these  epochs  for  S  were  higher  than  for  the  overall  period. 

Finally,  the  slope  estimates  for  each  of  the  three  epochs  in  the  power  law  analysis  of  the  se¬ 
verity  of  attacks  hovered  around  the  critical  value  of  2.0  (2.15,  1.95,  and  1.85,  in  chronological 
order).  All  of  them  are  statistically  significant  at  1%  level  of  confidence  and  high  fit.  Compared 
to  the  whole  period,  epochs  1  and  2  seemed  to  be  closer  to  the  process  of  the  overall  period. 

None  of  these  findings  are  available  through  plain  observation  or  even  field  visits  to  Iraq.  Al¬ 
though  more  traditional  methods  provide  significant  information  of  a  different  nature,  these  ana¬ 
lytical  results  provide  reliable  insights  concerning  conflict  dynamics.  Such  insights  shed  new 
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light  on  insurgent  activity  and  underlying  processes.  As  such,  these  insights  can  help  inform  po¬ 
licymakers  on  the  effectiveness  of  policies  implemented  or  under  consideration. 

Policy  Implications 

The  following  discussion  of  policy  implications  moves  from  some  basic  aspects  of  theoretical 
science  in  applied  domains  to  institutional  issues.  Throughout,  the  science-policy  nexus  domi¬ 
nates  the  discussion,  but  several  important  themes  are  only  summarized  due  to  space  limitations. 

To  begin,  the  scientific  principle  according  to  which  there  is  nothing  more  practical  than  a 
good  theory"  (Lewin,  [132])  is  or  should  be  as  valid  for  conflict  analysis  as  it  has  been  for  social 
psychology — a  science  that  evolved  from  humanistic  origins  dating  back  to  Aristotle.  In  fact,  as 
Vansteenkiste  and  Sheldon  [133]  have  noted,  Lewin  intended  to  convey  a  two-way  relationship 
between  scientists  and  practitioners,  such  that  the  two  would  gain  from  each  others’  insights  and 
specialized  familiarity  with  information,  issues,  and  methods — as  well  as  toolkits.  Whereas  com¬ 
putational  conflict  scientists  could  and  should  develop  research  that  yields  more  actionable  re¬ 
sults,  practitioners  could  and  should  make  greater  use  of  available  scientific  progress,  including 
viable  areas  of  social  science.  The  difficulties  for  each  are  many  but  the  potential  payoff  is  sig¬ 
nificant. 

Kline ’s  thesis  is  as  true  for  conflict  scientists  as  it  is  for  physicists — some  of  whom,  such  as 
L.  F.  Richardson  (founder  of  scientific  conflict  analysis)  have  made  contributions  to  the  science 
of  conflict.  Another  way  to  appreciate  the  power  of  scientific  approaches  to  conflict  analysis  is 
by  recalling  a  thesis  formulated  by  the  late  mathematician  Morris  Kline  [134]  that  scientists  do 
not  learn  mathematics  for  its  own  sake,  but  because  mathematics  provides  a  unique  and  powerful 
method  for  discovering  fundamental  features  of  the  real  empirical  world  that  are  not  accessible 
through  other  methods — including  direct  observation,  measurement,  or  experience.  Gravity, 
pressure,  and  radiation  are  among  the  many  natural  phenomena  that  are  understood  through  the 
exclusive  medium  of  mathematics,  even  when  one  can  observe  their  effects.  Much  the  same  is 
true  of  the  conflict  features  revealed  by  the  medium  of  theories  such  as  those  applied  in  this 
study.  Conflict  hazard  rates  (the  latent  intensity  for  attacks),  half-life  (the  greater-than-even-odds 
tipping  point  for  attacks  to  occur),  and  criticality  (the  phase  transition  to  an  extreme  threat  envi¬ 
ronment)  are  specific  features  of  adversarial  attacks  that  are  known  exclusively  through  the  me¬ 
dium  of  mathematics,  not  through  direct  experience  or  plain  observation. 

Within  a  politico-military  context,  the  situational  awareness  dashboard  of  conflict  analysts 
and  policymakers  could  be  significantly  enriched  by  adding  newpanels  for  viewing  computation¬ 
al  indicators,  such  as  those  applied  in  this  analysis  or  others  with  comparable  theoretical  founda¬ 
tion.  For  example,  application  of  these  methods  soon  after  the  ICG  Phase  I  (i.e.,  after  March 
2003)  would  have  revealed  the  gathering  momentum  of  the  insurgency  (at  least  in  Diyala),  per¬ 
haps  in  time  to  have  avoided  the  entrenchment  and  maturation  of  effective  insurgent  networks  by 
reformulating  an  appropriate  policy.  5  To  use  an  analogy,  such  latent  indicators — ^based  on  politi¬ 
cal  uncertainty  theory,  social  complexity  theory,  and  other  mathematical  or  computational  social 
science  theories — are  akin  to  measuring  pressure  changes  before  the  onset  of  a  storm,  or  radia¬ 
tion  prior  to  blast  pressure.  Further  testing  of  such  indicators  is  necessary,  now  that  theoretical 
and  methodological  foundations  exist.  A  better  dashboard — or  “computational  radar  screen” — 
could  help  policy  analysts  and  practitioners  navigate  with  reduced  risk  through  complex  threat 
environments  where  traditional  assessments  have  proven  to  be  insufficient. 
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Although  this  study  was  conducted  post-hoc,  by  necessity,  real-time  or  near  real-time  analy¬ 
sis  of  uncertainty  and  complexity  models  is  becoming  increasingly  feasible.  This  is  also  signifi¬ 
cant  within  a  politico-military  context.  Already  the  increased  interest  in  open  source  data  and 
analysis  on  the  part  of  the  intelligence  community  is  stimulating  a  new  generation  of  information 
processing  tools  that  will  one  day  provide  real-time  capabilities  in  events  analysis  and  related 
methodologies  [135].  In  addition,  the  merging  of  real-time  facilities  with  advanced  data  visuali¬ 
zation  and  cartographic  tools  (e.g.,  social  GIS,  spatial  social  science  models) — combined  with 
Moore’s  Law — will  soon  render  feasible  information  awareness  environments  that  would  have 
been  close  to  unthinkable  just  a  few  years  ago.  Real-time  events  data  analysis  will  provide  signif¬ 
icant  support  not  just  for  intelligence  analysts  but  also  for  planners,  decision  makers,  and  others 
that  can  benefit  from  feedback. 

Besides  these  improvements,  sequential  event  process  modeling  of  attacks — such  as  for  sui¬ 
cide  bombings  or  Improvised  Explosive  Device  (lED)  attacks — could  prove  helpful  for  practi¬ 
tioners,  as  well  as  challenging  from  a  scientific  perspective.  For  instance,  a  detailed  empirically 
based  event  process  model  (sometimes  known  as  a  “business  model”  in  organizational  theory)  of 
lED  attacks  could  shed  significant  light  on  the  attackers’  vulnerabilities,  by  revealing  actionable 
information  that  a  defender  could  exploit  to  prevent  attacks  or  mitigate  their  effects.  Models  like 
this  already  exist  for  weapons  of  mass  destruction  ([136],  chap.  15);  they  should  be  developed 
for  a  broad  variety  of  insurgency  and  irregular  warfare  attacks.  More  specifically,  event  process 
models  should  focus  on  phases  in  the  overall  life  cycle  of  an  attack: 

1 .  Decision  making:  Attackers  deciding  to  act,  including  cognitive  processes  and  alternative 
choice  mechanisms; 

2.  Planning:  Attackers  organizing  the  schedule  for  implementing  the  attack,  including  oper¬ 
ational  security; 

3.  Preparation:  Attackers  coordinating  the  tasks  necessary  to  execute  the  attack; 

4.  Execution:  Attackers  carrying  out  the  attack  that  causes  undesirable  effects  for  the  de¬ 
fender; 

5.  Effects:  Consequences  affecting  the  defender; 

6.  Recovery:  Defenders  restoring  partially  or  fully  restoring  their  condition,  including  socio- 
psychological  aspects; 

7.  Investigation:  Defenders  engaging  in  a  fact-finding  campaign  to  apprehend  attackers  and 
their  confederates;  and,  last  but  not  least; 

8.  Prosecution:  Defenders  apprehending  and  processing  attackers  through  the  criminal  jus¬ 
tice  system. 

The  simple  fact  that  the  operational  causal  structure  of  an  attack’s  processes  is  serialized — 
not  parallelized — ^holds  fundamental  and  inescapable  policy  and  practical  implications:  all  seria¬ 
lized  behavior  is  vulnerable  to  disruption  by  elimination  of  one  or  more  necessary  conjunctions. 
Effective  defenders  must  therefore  learn  how  to  exploit  the  inescapable  serialization  of  an  at¬ 
tacker’s  process — ^by  making  the  difficult  life  of  insurgents  almost  impossible  or  as  difficult  as 
possible. 

Of  course,  when  it  comes  to  the  complex  conflict  dynamics  of  insurgency  and  asymmetric 
warfare,  another  important  consideration  within  a  politico-military  context  is  that  not  all  the  ne- 
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cessary  conflict  science  is  known — ^not  even  for  selected  regions  of  the  world  or  for  subsets  of 
actors — and  much  will  remain  unknown  for  a  long  time,  even  as  better  data  and  better  theories 
are  developed  and  become  available  to  the  policy  community.  But  this  situation  in  the  politico- 
military  domain  of  national  security  is  not  different  from  what  occurs  in  medicine,  engineering, 
or  economics;  and  yet,  public  policy  in  these  areas  does  attempt  to  draw  on  the  best  existing 
scientific  understanding.  Understanding  what  one  does  not  know  is  as  important  as  mastering 
what  one  does  know. 

It  is  important  to  increase  the  availability  and  desirability  of  scientific  knowledge  on  conflict. 
The  main  findings  from  this  study — summarized  in  the  previous  section — offer  some  new  in¬ 
sights  that  are  worth  considering  in  the  domain  of  policy  analysis  and  planning.  This  study — and 
others  like  it  that  apply  computational  social  science  approaches  to  the  analysis  of  real-world 
conflict  events  [137],  [138],  [139],  [140],  [141]  — ^begin  to  indicate  that  some  new  systematic 
approaches  could  eventually  become  available  to  policy  analysts  and  practitioners.  Much  re¬ 
mains  to  be  demonstrated,  but  some  evidence  of  increasing  relevance  is  already  available. 

The  specific  policy  relevance  of  findings  such  as  those  reported  in  this  study  of  uncertainty 
and  complexity  patterns  in  adversary  behavior  must  be  judged  directly  in  terms  of  new  and  testa¬ 
ble  insights  and  understanding.  These  may  eventually  permit  different  courses  of  action,  or  vali¬ 
dation  of  policies  that  have  been  enacted  on  the  basis  of  different  criteria.  For  example,  the  ha¬ 
zard  force  analysis  is  capable  of  illuminating  the  conflict  process  by  revealing  phases  of  stability 
and  instability  that  are  otherwise  not  directly  observable,  even  through  the  direct  measurement  of 
trends  in  attack  frequencies  or  fatalities.  Likewise,  power  law  analysis  can  extract  signals — such 
as  the  trajectory  of  the  exponent  in  Equation  (5.2) —  capable  of  detecting  the  transformation  of  a 
threat  environment  or  the  increased  likelihood  of  extreme  attacks.  Again,  the  application  of  these 
methods  on  a  real-time  or  near  real-time  basis  soon  after  March  2003  would  have  revealed  the 
same  gathering  momentum  as  this  study — conducted  several  years  later.  The  deteriorating  condi¬ 
tions  detected  by  power  law  exponents  on  the  right-hand  panels  of  Tables  5.5  and  5.6  provide 
unambiguous  signals  of  an  increasingly  dangerous  threat  environment,  indicating  the  increasing 
need  for  a  counterinsurgency  campaign  that  should  have  begun  back  in  early  2004  at  the  lat¬ 
est — as  opposed  to  three  years  later.  Moreover,  such  policy-relevant  indicators  could  have  been 
scrutinized  by  the  scientific  community,  just  like  scientists  discuss  indicators  and  other  metrics  in 
numerous  fields  of  public  policy  ranging  from  environment  to  health. 

Besides  anticipating  the  rise  of  the  insurgency  in  Iraq,  deteriorating  hazard  forces  and  in¬ 
creasing  criticality  could  have  anticipated  the  process  of  ethno-sectarian  segregation  and  huma¬ 
nitarian  crisis  with  refugee  flows  within  Iraq  as  well  as  to  neighboring  countries.  This  is  because, 
based  on  well-established  concepts  and  principles  of  social  science,  social  segregation — not  just 
in  situations  like  those  in  Iraq,  but  also  in  many  urban  areas — is  an  emergent  collective  pheno¬ 
menon  that  is  driven  by  many  individual  localized  decisions  that  depend  on  tolerance  for  ethnic 
or  sectarian  diversity.  In  turn,  such  tolerance  depends  on  trust  and  social  bonds  of  reciprocity, 
collaboration,  and  expectations  in  terms  of  time  horizon.  When  violence  increases — as  it  did 
with  incipient  insurgency — fear  in  the  populace  also  increased,  leading  to  mistrust  (ethnically 
diverse  but  formerly  trusted  neighbors  can  no  longer  be  trusted),  which  leads  to  movement  to 
regain  security,  which  results  in  a  collective  pattern  of  segregation.  Although  the  long  chain  of 
events  may  give  the  appearance  of  a  Rube  Goldberg  process,  the  social  scientific  understanding 
of  segregation  processes  has  solid  foundations  in  the  pioneering  work  of  Thomas  Schelling  [142] 
and  others.  Today,  agent-based  models  of  segregation  offer  unique  and  powerful  computational 
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tools  for  understanding  ethno-sectarian  segregation  in  irregular  conflicts  and — ^with  added  neces¬ 
sary  refinements — for  exploring  and  designing  better  preventive  and  mitigating  policies.  Some 
[135]  have  recently  argued  that  one  desirable  course  of  action  would  be  a  comprehensive  thrust 
to  increase  the  policy  relevance  of  scientific  conflict  analysis  to  increase  national  capability  in 
this  area — and  in  a  timely  fashion  consistent  with  due  scientific  processes  concerning  testing, 
replication,  peer  review,  publication,  and  other  quality  control  mechanisms.  This  too,  like  Te¬ 
win’ s  adage,  is  a  two  way  interaction  between  science  and  policy.  The  computational  social 
science  of  conflict  can  benefit  from  greater  exposure  to  policy  concerns  (not  limited  to  national 
security),  and  policy  analysts  and  practitioners  can  benefit  from  new  insights  and  understanding 
derived  from  science.  The  science  of  conflict  (and  peace)  will  always  benefit  from  direct  chal¬ 
lenges  originating  from  the  policy  community,  and — vice  versa — the  national  security  policy 
community  will  benefit  from  advances  in  the  relevant  areas  of  social  science  that  investigate  con¬ 
flict. 

Admittedly,  practical  policy  solutions  unfounded  in  science  can  sometimes  suffice,  assuming 
some  luck.  Indeed,  the  Romans  were  able  to  build  bridges  that  were  sufficiently  reliable  to  ad¬ 
vance  their  military  and  strategic  purposes — and  indeed  many  Roman  bridges  are  still  intact  and 
fully  operable  today — without  any  scientific  understanding  of  the  true  laws  of  mechanics.  Al¬ 
though  this  is  certainly  true — one  does  not  need  a  complete  science  of  conflict  to  improve  cur¬ 
rent  performance  against  adversaries — ^there  is  no  denying  that  modem  bridges  built  by  modem 
science  and  engineering  have  vastly  superior  performance  characteristics  than  their  earlier  Ro¬ 
man  counterparts.  The  same  is  tme  for  designing  more  effective  counterinsurgency  policies: 
much  can  be  gained  in  terms  of  experience  and  other  practical  data,  but  a  great  deal  more  can  be 
attained  by  exploiting  scientific  knowledge  based  on  testable  ideas  and  valid  theories. 

Ultimately,  scientific  analysis  of  adversary  threat  environments  can  provide  alternative 
views  and  insights  that  add  value,  based  on  replicable  methods  and  inter-subjective  standards 
that  are  less  personal  or  affected  by  biases.  As  well,  the  growing  body  of  scientific  knowledge 
about  conflicts  of  many  kinds — ^not  just  the  insurgency  and  irregular  warfare  type  of  attacks  ex¬ 
amined  in  this  study — might  yet  find  its  way  into  the  policy  process,  much  in  the  same  way  as 
knowledge  from  the  economic  sciences  and  the  biological  sciences  has  contributed  to  better  eco¬ 
nomic  policies  and  public  health  policies,  respectively.  Such  a  prospect  leads  to  a  final  point 
concerning  policy  dimensions  of  scientific  approaches  to  conflict  analysis. 

From  an  institutional  perspective,  the  national  security  policy  of  the  American  polity —  com¬ 
prised  of  foreign  and  defense  policies — is  distributed  across  a  number  of  departments  and  agen¬ 
cies;  components  of  the  national  system  of  government.  However,  the  distribution  of  science  and 
engineering  expertise  or  receptivity  across  these  components,  or  even  within  them,  is  far  from 
even.  Some  government  institutions  are  more  appreciative  of  science  than  others.  The  result  of 
this  uneven  landscape  is  not  only  a  differential  appreciation  for  science  across  departments  and 
agencies,  but  cultural  and  attitudinal  differences  that  render  the  adoption  of  scientific  methods 
and  greater  systematic  rationality  problematic  in  some  quarters — especially  those  affected  by 
ideology.  C.  P.  Snow’s  “two  cultures”  coexist,  often  under  considerable  stress,  throughout  many 
areas  of  the  national  security  establishment —  including  the  legislative  branch.  Advancing  the 
role  of  science  in  the  area  of  national  security  policy  is  a  complex  organizational  process  that  in¬ 
volves  not  only  scientists  and  practitioners,  but  the  institutions  and  norms  within  which  they  op¬ 
erate.  The  same  is  true  in  allied  countries  that  share  similar  concerns  to  America’s. 
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5.1.5  Summary 

Neither  time  between  attacks  T  or  severity  of  attacks  S  (fatalities)  have  a  normal  or  log-normal 
distribution.  Instead,  both  variables  showed  heavy  tails,  symptomatic  of  non-equilibrium  dynam¬ 
ics,  in  some  cases  coming  close  to  approximating  a  power  law  with  critical  or  near  critical  expo¬ 
nent  value  of  2.  The  empirical  hazard  force  analysis  in  both  cases  showed  that  the  intensity  was 
high  for  the  first  occurrences  in  both  variables,  namely  between  March  2003  and  June  2004. 
Moreover,  the  average  empirical  hazard  rate  clearly  increased  throughout  the  three  epochs,  sup¬ 
porting  the  article’s  main  hypotheses.  These  findings — and  the  underlying  theoretical  approach 
and  methodology —  demonstrate  the  potential  value  of  adversarial  models  for  conflict  analysis. 
From  an  applied  policy  perspective,  the  article  highlighted  the  additional  knowledge  contributed 
by  these  kinds  of  analysis,  including  the  fact  that  real-time  or  near  real-time  implementation  of 
these  methods  could  have  revealed  the  surge  of  insurgents  in  Diyala,  Iraq,  relatively  soon  after 
March  2003.  These  and  related  methods  from  the  computational  social  science  of  conflict  should 
be  viewed  within  the  broader  context  of  science  and  policy. 
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5.2  Timed  Influence  Nets  Applied  to  the  Suppression  of  lEDs  in  Diyala,  Iraq 


Lee  W.  Wagenhals  and  Alexander  H.  Levis 


5.2.1  Introduction 

A  case  study  was  developed  to  demonstrate  the  capability  of  Timed  InfluenceN  to  develop  and 
analyze  courses  of  action.  The  specific  issue  that  the  case  study  addressed  was  stated  as  follows: 
given  a  military  objective  and  a  set  of  desired  effects  derived  from  statements  of  commander’s 
intent,  develop  and  analyze  alternative  courses  of  actions  (COAs)  that  will  cause  those  desired 
effects  to  occur  and  thus  achieve  the  military  objective.  Specifically,  the  case  study  demonstrat¬ 
ed  the  use  of  a  TIN  tool  called  Pythia  that  has  been  developed  at  George  Mason  University.  This 
demonstrated  the  use  of  the  tool  to  create  knowledge  about  an  adversary  and  the  population  that 
potentially  supports  or  resists  that  adversary  and  the  use  of  the  TIN  to  analyze  various  COAs. 

A  scenario  was  chosen  based  on  the  problem  of  suppressing  the  use  of  Improvised  Explosive 
Devices  (lEDs)  in  a  specific  province  of  Iraq,  denoted  as  province  D  in  the  year  2005.  Specifi¬ 
cally,  it  is  assumed  that  lED  incidents  have  increased  along  two  main  east-west  routes  between 
the  capital  town  C  of  the  province  and  a  neighboring  country  M.  Both  roads  are  historically  sig¬ 
nificant  smuggling  routes. 

There  were  hundreds  of  documents  about  Iraq  in  general  and  D  province  in  particular  that 
were  reviewed  to  get  a  better  understanding  of  the  situation.  The  province  includes  substantial 
fractions  of  Kurdish,  Shia,  and  Sunni  populations  as  well  as  other  minorities.  It  was  noted  that 
the  northern  route  was  in  the  predominantly  Kurdish  region  and  the  southern  route  was  in  a  pre¬ 
dominantly  Shia  region.  A  dynamic  tension  existed  between  these  regions  particularly  with  re¬ 
gard  to  the  flow  of  commerce  (overt  and  covert)  because  of  the  revenue  the  flow  generated.  It 
was  noted  that  some  revenue  was  legitimate,  but  a  significant  amount  was  not  and  was  consi¬ 
dered  covert.  Increased  lEDs  in  one  region  tended  to  suppress  the  trade  flow  in  that  region  and 
caused  the  flow  to  shift  to  the  other.  Consequently,  each  region  would  have  preferred  to  have  the 
lEDs  suppressed  in  its  region,  but  not  necessarily  in  the  neighboring  region.  The  lED  perpetra¬ 
tors  needed  support  from  the  local  and  regional  populations  as  well  as  outside  help  to  carry  out 
their  attacks.  The  support  was  needed  for  recruiting  various  individuals  to  help  manufacture  the 
lEDs  and  to  carry  out  the  operations  necessary  to  plant  them  and  set  them  off  It  was  postulated 
that  improving  the  local  economy  and  the  quality  of  the  infrastructure  services  would  reduce  the 
local  and  regional  support  to  the  insurgents.  Of  course,  this  required  effective  governance  and 
willingness  on  the  part  of  the  workers  to  repair  and  maintain  the  infrastructure  that  in  turn  re¬ 
quired  protection  by  the  Iraqi  security  and  coalition  forces. 

5.2.2  Model  Development 

With  this  basic  understanding,  the  following  steps  were  taken  to  create  the  TIN.  First  the  overall 
key  effects  were  determined  to  be: 

1)  lED  attacks  are  suppressed  on  routes  A  and  B  (note  these  were  modeled  as  separate  ef¬ 
fects  because  it  may  be  possible  that  only  one  of  the  routes  may  have  the  lED  attacks 
suppressed), 

2)  Covert  economic  activity  improves  along  each  of  the  two  routes. 

3)  Overall  overt  economic  activity  increases  in  the  region. 


79 


4)  Insurgent  fires  are  suppressed, 

5)  Local  support  for  the  insurgents  exist  and 

6)  Regional  support  for  the  insurgents  exists. 

Nodes  for  each  of  these  effects  were  created  in  the  Pythia  TIN  modeling  tool.  It  was  noted 
that  suppression  of  lED  attacks  on  one  route  could  have  an  inverse  effect  on  the  covert  economic 
activity  on  the  other,  but  each  could  improve  the  overall  overt  economic  activity.  The  suppres¬ 
sion  of  the  insurgent  fires  positively  affected  both  covert  and  overt  economic  activity. 

The  next  step  was  to  identify  the  key  coalition  force  (Blue)  actions  that  would  be  evaluated 
as  part  of  the  potential  overall  COA.  To  be  consistent  with  the  level  of  model  abstraction  the 
follow  high  level  actions  were  considered:  1)  Blue  coalition  forces  (CF)  exercise  their  standard 
Tactics,  Techniques,  and  Procedures  (TPPs)  (including  patrols,  searches,  presence  operations, 
and  the  like).  2)  Blue  Coalition  Forces  actively  conduct  surveillance  operations.  3)  Blue  CF  ac¬ 
tively  conduct  Information  Operations.  4)  Blue  CF  continue  to  train  the  local  Iraqi  security 
forces  and  police.  5.  Blue  CF  broker  meetings  and  discussions  between  various  Iraqi  factions 
(Green). 

Of  course,  it  is  not  possible  to  just  connect  these  actions  to  the  key  effects  and,  therefore, 
several  other  sub-models  were  constructed  and  then  linked  together  to  produce  the  final  model. 
These  models  include  a  model  of  the  process  the  insurgents  must  use  to  conduct  lED  operations, 
a  sub-model  for  the  infrastructure  and  economic  activity,  and  a  sub  model  of  the  political  and 
ethno-religious  activities.  In  addition,  it  was  recognized  that  the  region  was  being  influenced  by 
outside  sources,  so  these  also  were  added  to  the  model. 

The  sub  model  of  the  insurgent  lED  activities  was  based  on  the  concept  of  how  the  insur¬ 
gents  develop  an  lED  capability.  They  must  have  the  lEDs,  the  personnel  to  carry  out  the  lED 
operation,  the  communication  systems  to  coordinate  the  operation  and  the  surveillance  capability 
to  determine  where  to  place  the  lED  and  when  to  set  it  off.  Each  of  these  in  turn  requires  addi¬ 
tional  activities.  For  example,  the  personnel  must  be  recruited  and  trained.  The  lEDs  must  be 
manufactured,  and  this  requires  material  and  expertise.  Furthermore,  the  insurgents  must  be  mo¬ 
tivated  to  use  their  capability.  Much  of  this  capability  relies  on  support  by  the  local  and  regional 
population  and  funding  and  material  from  outside  sources.  The  nodes  and  the  directed  links  be¬ 
tween  them  were  added  to  the  TIN  model  to  reflect  the  Insurgents’  Activities. 

The  economic  and  infrastructure  sub-model  included  nodes  for  each  of  the  main  essential 
services:  water,  electricity,  sewage,  health,  and  education.  It  also  included  financial  institutions 
(banks,  etc.)  and  economic  activities  such  as  commerce  and  retail  sales  of  goods.  The  nodes  for 
the  economic  and  infrastructure  aspect  of  the  situation  were  linked  to  the  local  and  regional  sup¬ 
port  as  well  as  to  the  overall  effect  on  the  overt  economic  activity. 

Of  course,  the  economic  and  infrastructure  services  will  not  function  properly  without  the  sup¬ 
port  of  the  Political  and  Ethno-Religious  entities  in  the  region.  Thus  a  sub-model  for  these  fac¬ 
tors  was  also  included.  To  do  this,  three  facets  of  the  region  were  considered:  the  religious  activ¬ 
ities  including  Shia,  Sunni,  and  Kurdish  (who  are  either  Shia  or  Sunni)  groups,  political  party 
activities  (Shia,  Sunni,  and  Kurdish),  and  the  Shia,  Sunni,  and  Kurdish  activities  within  the  gov¬ 
ernment  structure  including  the  civil  service  and  the  police  and  law  enforcement  institutions. 
The  nodes  for  all  of  these  activities  were  created  and  appropriate  links  were  created  between 
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them.  Links  were  also  created  to  other  nodes  in  the  model  such  as  local  and  regional  support  of 
the  insurgents,  economic  activity  and  infrastructure  development. 

Finally,  the  outside  influences  were  added  to  the  model.  These  include  external  support  for 
the  insurgents,  anti-coalition  influences  from  neighboring  countries,  and  external  financial  sup¬ 
port  for  the  local  government  and  the  commercial  enterprises  of  the  region.  All  of  these  nodes 
were  modeled  as  actions  nodes  with  no  input  links.  With  this  model  design,  analysts  could  expe¬ 
riment  with  the  effects  of  different  levels  of  external  support,  both  positive  and  negative,  on  the 
overall  outcomes  and  effects. 

The  complete  model  is  shown  in  Fig.  5.24.  The  model  has  62  nodes,  including  16  nodes  with 
no  parents,  and  155  links. 


International  Influences 


Fig.  5.24  Complete  model  of  the  case  study  TIN 


Once  the  structure  of  the  models  was  completed,  the  next  step  was  to  assign  the  values  to  the 
parameters  in  the  model.  This  was  done  in  two  steps.  First,  the  strengths  of  the  influences  (the  g 
and  h  parameters  on  each  link)  and  the  baseline  probability  of  each  node  were  selected.  This 
may  seem  like  a  daunting  task  given  the  subjective  nature  of  the  problem  and  the  number  of  links 
and  nodes.  However,  TINs  and  the  Pythia  tool  limit  the  choices  that  can  be  made  for  these  pa¬ 
rameters.  For  each  link,  the  model  determines  the  impact  of  a  parent  node  on  a  child  node  first  if 
the  parent  is  true  and  then  if  the  parent  is  false.  The  choices  range  from  very  strongly  promoting 
(meaning  nearly  100%),  strong  (quite  likely,  but  not  100%),  moderate  (50%  or  greater,  but  less 
than  strong),  slight  (greater  than  0%  but  not  likely),  or  no  effect.  The  modeler  can  also  select  a 
similar  set  of  inhibiting  strengths  ranging  from  very  strongly  inhibiting  to  no  effect.  The  second 
set  of  parameters  is  the  baseline  probabilities  of  the  node.  These  are  set  to  a  default  value  of  0.5 
meaning  that  the  probability  of  the  node  being  true  is  0.5  given  no  other  influences  or  causes  (we 
don’t  know).  In  many  cases,  the  default  value  was  selected. 


At  this  point  it  is  possible,  if  not  prudent,  to  perform  some  analysis  on  the  model  to  observe 
its  behavior.  We  will  describe  this  in  detail  shortly.  The  final  step  in  creating  the  TIN  model 
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was  to  assign  the  temporal  parameter  values  to  the  nodes  and  the  links.  The  default  value  for 
these  is  0.  With  all  values  set  to  0  the  model  is  identical  to  an  ordinary  Influence  Net.  The 
process  for  assigning  the  time  delay  values  is  similar  to  that  for  assigning  the  strengths  of  the  in¬ 
fluences  and  the  baseline  probabilities.  For  each  link,  the  modeler  determines  how  long  it  will 
take  for  the  child  node  to  respond  to  a  change  in  the  probability  of  the  parent  node.  In  some  cas¬ 
es  the  change  is  instantaneous,  so  the  default  value  of  0  is  appropriate.  In  others,  a  time  delay 
may  be  expected.  Part  of  this  process  requires  that  the  modeler  establish  the  time  scale  that  will 
be  used  in  the  model  and  thus  what  actual  time  length  of  one  unit  of  delay  is.  Any  unit  of  meas¬ 
ure  can  be  selected  from  seconds  to  days,  weeks,  months  or  even  years.  In  this  particular  model 
each  time  delay  unit  was  set  to  be  one  week.  In  setting  the  time  delay  of  the  arcs,  it  may  also  be 
useful  to  set  the  time  delay  of  the  nodes.  Again  the  default  value  for  this  delay  is  0.  This  delay 
represents  processing  delay.  It  reflects  the  concept  that  if  there  is  a  change  in  one  or  more  of  the 
parent  nodes,  once  the  child  node  realizes  that  the  change  has  occurred,  there  may  be  some  time 
delay  before  it  processes  this  new  input  and  changes  its  probability  value. 

5.2.3  Model  Validation 

Once  the  complete  TIN  was  created,  a  validation  of  the  model  was  undertaken.  This  was  done 
by  consulting  with  several  subject  matter  experts  who  had  been  in  the  region  and  were  familiar 
with  the  situation.  Each  node  and  link  was  checked  to  see  if  the  node  and  the  relationships  to 
and  from  that  node  made  sense.  In  short,  we  were  confirming  that  the  overall  structure  of  the 
model  made  sense.  Several  suggestions  were  made  and  the  changes  were  incorporated.  Once 
the  structure  had  been  vetted,  then  the  parameters  were  checked.  This  was  done  link  by  link  and 
node  by  node.  First  the  strengths  of  the  influences  were  checked,  then  the  baseline  probabilities, 
and  finally  the  time  delays. 

5.2.4  Analysis 

Once  the  TIN  model  was  finished  and  validated,  two  levels  of  analysis  were  accomplished  to 
demonstrate  the  utility  of  the  approach.  The  first  level  is  the  logical  level.  This  can  be  done 
without  using  the  parameters  because  it  only  requires  the  structure  of  the  model.  At  this  level  of 
analysis  the  model  shows  the  complex  causal  and  influencing  interrelationships  between  Blue 
CF,  the  external  influence,  the  religious  and  political  factions,  the  adversary  (Red),  and  the  local 
and  regional  population  (Green).  This  particular  model  shows  that  while  Blue  CF  has  some  leve¬ 
rage,  there  are  many  other  outside  influences  that  also  can  affect  the  outcome  of  any  actions  that 
Blue  may  take.  The  model  identifies  these  influences  and  how  they  may  help  inhibit  the 
progress  that  is  made  as  a  result  of  Blue  CF  actions.  Furthermore,  the  model  shows  relationships 
between  the  actions  and  activities  of  major  religious  and  ethnic  groups  and  effects  on  govern¬ 
ment  activities  (police,  judiciary,  public  works  and  service,  etc.).  It  shows  the  impact  of  the  ade¬ 
quacy  of  government  and  public  services  on  support  of  the  insurgency.  It  captures  the  lED  de¬ 
velopment,  planning,  and  employment  processes  and  the  impact  of  the  other  activities,  the  status 
of  public  services,  and  coalition  interventions  on  those  processes.  Finally  the  model  captures 
interaction  of  lED  attack  suppression  on  two  major  trade  routes  (suppressing  one  route  increases 
attacks  on  the  other).  In  short,  the  model  has  captured  Blue’s  understanding  of  a  very  complex 
situation  and  can  help  articulate  concepts  and  concerns  involved  in  COA  analysis  and  selection. 

The  second  level  of  analysis  involves  the  behavior  of  the  model.  It  is  divided  into  a  static 
quantitative  and  a  dynamic  temporal  analysis.  The  static  quantitative  analysis  requires  the  struc¬ 
ture  of  the  model  and  the  non  temporal  parameters  to  be  set.  The  temporal,  time  delay  parame- 
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ters  should  be  set  to  the  default  value  of  0.  This  analysis  enables  one  to  compare  COAs  based  on 
the  end  result  of  taking  the  actions  in  the  CO  A.  In  the  Province  D  model,  four  major  COAs  were 
assessed  as  shown  in  Fig.  5.25.  This  table  has  four  parts,  an  Action  stub  in  the  upper  left  comer, 
the  Action  or  COA  matrix  to  the  right  of  the  Action  stub,  an  Effects  stub  below  the  Action  stub, 
and  the  Effects  matrix  adjacent  to  the  Effects  stub.  In  the  COA  matrix,  the  set  of  COAs  that  have 
been  evaluated  are  listed  with  an  X  showing  the  actions  that  comprise  the  COA.  The  Effects  ma¬ 
trix  shows  the  corresponding  effects  as  the  probability  of  each  effect. 


Actions 

Situation 
(COA)  1 

Situation 
(COA)  2 

Situation 
(COA)  3 

Situation 
(COA)  4 

International  Interference 

X 

X 

X 

X 

External  Financial  Support 

X 

X 

X 

CF  UEi  and  Surveillance 

X 

X 

X 

CF  10,  training,  brokering 

X 

X 

Iraqi  political  and  religious  group  participation 

X 

EFFECTS 

Local  and  Region  Support  for  Insurgents  Exists 

0.97 

0.92 

0.26/0.36 

0.22/0.14 

lED  Attacks  Suppressed  on  Route  A  /  B 

0.17/0.15 

0.31/0.34 

0.67/0.68 

0.85/0.74 

Insurgenfs  fires  suppressed 

0.14 

0.65 

0.9 

0.93 

Public  services  adequate 

0.12 

0.39 

0.39 

0.55 

Overt  Economic  Activity  Increasing 

0.02 

0.08 

0.31 

0.89 

Covert  Economic  Activity  Increasing  along  routes 
A  and  B 

0.37 

0.50 

0.56 

0.57 

Fig.  5.25  Static  Quantitative  COA  Comparison 

COA  1  was  a  baseline  case  in  which  only  international  interference  and  support  to  the  insur¬ 
gency  occurs.  There  is  no  action  from  the  Blue  CF,  no  external  financial  support  to  the  infra- 
stmcture  and  the  economy,  and  the  religious  and  political  factions  are  not  participating  in  the  go¬ 
vernance  of  the  area.  The  overall  effects  are  shown  in  the  lower  part  of  the  matrix.  The  results 
for  this  COA  are  very  poor.  There  is  support  for  the  insurgency  and  it  is  very  unlikely  that  the 
lED  attacks  will  be  suppressed  on  either  route.  With  an  ineffective  local  government,  the  basic 
services  are  inadequate  which  encourages  the  support  to  the  insurgency  and  there  is  little  chance 
for  economic  increase. 

COA  2  represents  the  case  where  external  financial  support  is  provided  and  the  coalition 
forces  are  active  both  in  presence  operations  and  in  conducting  surveillance.  However,  Informa¬ 
tion  Operations,  training  of  Iraqi  forces  and  workers,  and  brokering  of  meetings  and  agreement 
between  Iraqi  factions  are  not  occurring.  In  addition,  the  political  and  religious  groups  are  not 
participating  in  positive  governance  and  support  to  civil  service.  In  this  case,  there  is  some  im¬ 
provement  compared  to  COA  1,  but  still  there  are  many  problems.  Local  support  for  the  insur¬ 
gents  is  still  very  strong,  although  there  is  some  suppression  of  the  lED  attacks  and  insurgent 
fires  due  to  the  activities  of  the  coalition  forces.  As  a  result  there  is  some  improvement  in  public 
services  and  an  increase  in  covert  and  overt  economic  activity,  due  in  part  to  the  reduction  in 
lED  attacks  and  insurgent  fires. 

The  third  COA  contains  all  of  the  actions  of  COA  2  plus  the  addition  of  coalition  force  in¬ 
formation  operations,  training  of  Iraqi  security  and  police  forces  as  well  as  civilian  infrastructure 
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operations  and  significant  brokering  of  meetings  and  agreements  between  the  various  Iraqi  agen¬ 
cies  and  factions.  The  result  is  a  significant  improvement  in  the  suppression  of  the  lED  attacks 
and  insurgent  fires  due  to  the  improved  capabilities  of  the  Iraqi  security  and  police  forces  and  the 
significant  drop  in  the  local  and  regional  support  of  the  insurgents.  There  is  also  a  significant 
improvement  in  the  covert  and  overt  economic  activity.  However,  there  is  little  change  in  the 
adequacy  of  the  public  services,  due  primarily  to  the  lack  of  effective  participation  of  the  Iraqi 
governance  function. 

The  last  COA  has  all  actions  occurring.  In  addition  to  the  activities  of  the  previous  three 
COAs,  COA  4  includes  the  active  participation  of  the  Iraqi  religious  and  political  groups  in  the 
governance  activities.  It  results  in  the  highest  probabilities  of  achieving  the  desired  effects. 
While  there  is  still  some  likelihood  or  local  and  regional  support  for  the  insurgents  (0.22  and 
0.14,  respectively),  many  of  the  lED  attacks  are  suppressed  as  are  the  insurgent  fires.  The  result 
is  significant  increases  in  overt  economic  activity  and  moderate  increase  in  the  covert  economic 
activity.  Public  services  are  still  only  moderately  adequate,  with  room  for  improvement. 

While  the  static  quantitative  analysis  provides  a  lot  of  insight  into  the  potential  results  of  var¬ 
ious  COAs,  it  does  not  address  the  questions  of  how  long  it  will  take  for  the  results  to  unfold  or 
what  should  the  timing  of  the  actions  be.  The  dynamic  temporal  analysis  can  provide  answers  to 
these  types  of  questions. 

Having  created  the  TIN  model  with  the  time  delay  information,  it  is  possible  to  experiment 
with  various  COAs  and  input  scenarios.  Figure  5.26  shows  an  example  of  COA  and  input  scena¬ 
rios  that  illustrate  such  an  experiment.  The  second  column  of  the  Table  in  Fig.  6  shows  a  sum¬ 
mary  of  the  input  nodes  that  were  used  in  the  experiment.  They  are  divided  into  two  types,  those 
listed  as  Scenario  and  those  listed  as  COA  Actions.  The  scenario  portion  contains  actions  that 
may  take  place  over  which  limited  control  is  available.  These  set  the  context  for  the  experiment. 
The  second  group  contains  the  actions  over  which  control  exists,  that  is  the  selection  of  the  ac¬ 
tions  and  when  to  take  them  is  a  choice  that  can  be  made.  The  last  column  shows  the  scena¬ 
rio/action  combinations  that  comprise  the  COA/Scenario  to  be  examined.  The  column  provides 
a  list  of  ordered  pairs  for  each  Scenario  Action  or  COA  Action.  Each  pair  provides  a  probability 
(of  the  action)  and  a  time  when  that  action  starts.  For  example,  the  listing  for  the  second  scena¬ 
rio  actions  is  [0.5,  0]  [1.0,  1]  which  means  that  the  probability  of  Country  M  and  Country  L  in¬ 
terfering  is  0.5  at  the  start  of  the  scenario  and  changes  to  1.0  at  time  =  1.  In  this  analysis,  time  is 
measured  in  weeks. 

The  entries  under  the  column  labeled  “COA  4a”  mean  that  the  scenario/under  which  the 
COA  being  tested  is  one  in  which  there  is  immediate  and  full  support  for  the  insurgency  (finan¬ 
cial,  material,  and  personnel)  from  international  sources,  and  it  is  expected  to  exist  throughout 
the  scenario.  The  same  is  true  for  support  from  Country  S.  Countries  M  and  L  are  modeled  with 
the  probability  of  providing  support  at  0.5  initially,  but  it  immediately  increases  to  1.0  at  week  1. 
All  of  the  COA  actions  are  assumed  to  not  have  occurred  at  the  start  of  the  scenario,  thus  the  first 
entry  of  each  is  [0,  0].  The  coalition  force  (Blue)  actions  start  at  week  1  with  a  probability  of 
1.0,  meaning  that  all  of  the  elements  of  Blue  actions  start  at  the  beginning.  With  regard  to  reli¬ 
gious  activities,  the  Kurds  begin  at  week  1  with  probability  1.0.  The  Shia  and  Sunni  have  a 
probability  of  0.5  starting  at  week  10  and  then  increase  to  1.0,  becoming  fully  engaged  at  week 
20.  In  terms  of  political  activity,  the  Kurds  and  Shia  become  frilly  active  at  week  1 .  The  Shia 
become  more  likely  to  be  active  at  week  10,  fully  active  at  week  20,  then  become  less  likely  to 
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be  active  at  week  30  (probability  0.5)  and  then  become  fully  active  again  at  week  40.  Finally, 
the  External  Financial  support  begins  at  week  26. 


Action 

COA  4a:  List  [p,t]  | 

4  Scenario 

Int’l  Support  to  Insurgents 

[1.0,0]  I 

y 

Actions 

Interference  by  countries  M  and  L 

[0.5,0],  [1.0,1]  1 

1 

Interference  by  country  S 

[1.0,  0]  I 

^  COA 

i 

Blue  activated 

[0,0],  [1.0,1]  1 

/  Actions 

Blue  Suiveillance,  10,  Training,  Brokering 

[0,0],  [1.0,  1]  1 

1 

and  Sunni  Religious  Activity 

[0,  0],  [O.S,  10],  [1.0,  20]  1 

Kurd  Religious  Activity 

[0,0],  [1.0,  1]  1 

Kurd  and  Political  Activity 

[0,0],  [1.0,  1]  1 

Sunni  Political  Activity 

[0,  0],  [1.0,  20],  [0.5,  30],  [1.0,  40]  | 

L_ 

International  Investment 

[0,  0],  [1.0,  2S]  1 

Fig.  5.26  Dynamic  Temporal  Analysis  Input 

To  see  what  the  effect  of  this  input  scenario  on  several  key  effects,  the  model  is  executed  and 
the  probabilities  of  the  key  effects  as  a  function  of  time  are  plotted  as  shown  in  Fig.  5.27.  In  the 
figure,  the  probability  profiles  of  four  effects  are  shown:  lEDs  are  suppressed  on  Routes  A  and  B 
and  Local  and  Regional  support  for  the  Insurgents  exists. 

Figure  5.27  shows  that  the  probability  of  suppression  of  the  lED  attacks  on  the  two  routes  in¬ 
creases  significantly  under  this  scenario.  This  means  that  the  number  of  lED  attacks  should  de¬ 
crease,  more  on  Route  A  than  on  Route  B.  The  improvement  can  be  expected  to  occur  more  ra¬ 
pidly  along  Route  A  than  along  Route  B  by  about  35  weeks  or  8  months.  Route  A  is  the  north¬ 
ern  route  that  is  controlled  by  the  Kurds  and  Route  B  is  the  southern  route  controlled  by  the  Shia 
and  Sunni.  This  can  be  attributed  to  the  rapid  and  steadfast  political  and  religious  activities  of 
the  Kurds  as  opposed  to  the  more  erratic  activities  of  the  others  as  modeled  in  the  input  scenario 
(Fig.  5.26).  Also  note  that  it  is  expected  to  take  80  to  100  weeks  (nearly  2  years)  for  the  full  ef¬ 
fect  to  occur.  Fig.  5.27  also  shows  a  significant  decline  in  support  for  the  insurgents  both  by  the 
local  and  the  regional  populace  with  the  local  support  decreasing  more  as  the  situation  with  re¬ 
spect  to  governance  and  services  improves. 

Of  course  it  is  possible  to  examine  the  behavior  of  any  of  the  nodes  in  the  model,  by  plotting 
their  probability  profiles.  This  can  increase  the  understanding  of  the  complex  interactions  and 
dependencies  that  in  the  situation  that  have  been  expressed  in  the  TIN  model.  The  TIN  model 
provides  a  mechanism  to  experiment  with  many  different  scenarios  and  COAs.  Questions  like 
what  will  happen  if  some  of  the  Blue  CF  actions  are  delayed  or  what  will  happen  if  the  Shia  or 
Sunni  decide  not  to  participate  after  some  period  of  time  can  be  explored.  By  creating  plots  of 
the  probability  profile  of  key  effects  under  different  scenarios,  it  is  possible  to  explore  the  differ¬ 
ences  in  expected  outcomes  under  different  scenarios.  This  can  be  illustrated  by  changing  the 
input  scenario.  Suppose  that  it  is  believed  to  be  possible  to  get  other  countries  or  external  organ¬ 
izations  to  reduce  the  support  to  the  insurgents  by  some  means,  for  example  diplomatic  or  mili¬ 
tary  action.  It  is  postulated  that  we  could  reduce  the  likelihood  of  such  support  to  about  50%  but 
it  will  take  6  months  to  do  this.  The  results  can  be  modeled  by  changing  the  input  scenario  of 
Fig.  5.26.  In  this  case  the  first  line  of  Fig.  5.26  is  changed  from  [1.0,  0]  to  [1.0,  0]  [0.5,26].  All 
of  the  other  inputs  remain  the  same.  Figure  5.28  shows  a  comparison  of  effect  of  this  change  on 
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the  suppression  on  lED  attacks  along  Route  B.  The  reduction  in  international  support  for  the  in¬ 
surgents  at  week  26  can  cause  a  significant  improvement  in  the  suppression  of  the  lED  attacks 
along  Route  B  (and  a  corresponding  improvement  along  Route  A,  not  shown).  The  improvement 
begins  about  6  months  after  the  reduction  in  international  support  or  about  1  year  into  the  scena¬ 
rio.  Thus,  decision  makers  may  wish  to  pursue  this  option. 


Fig.  5.27  Probability  Profiles  of  Scenario  (COA)  of  Fig.  5.26 

5.2.5  Observations  and  Conclusions 

Creating  TIN  models  of  situations  provides  a  representation  of  knowledge  about  a  situation  that 
is  derived  from  an  understanding  of  the  capabilities  of  an  adversary  and  the  interactions  and  de¬ 
pendencies  of  that  adversary  with  the  local  and  regional  social,  religious,  and  economic  condi¬ 
tion.  Once  created,  the  TIN  model  can  be  used  to  conduct  computational  experiments  with  dif¬ 
ferent  scenarios  and  COAs.  In  a  sense,  it  provides  a  mechanism  to  assess  various  COAs  based 
upon  comparisons  of  the  change  in  the  probability  of  key  effects  over  time 

It  is  important  to  emphasize  that  the  purpose  of  these  models  is  to  assist  analysts  in  under¬ 
standing  the  potential  interactions  that  can  take  place  in  a  region  based  on  actions  taken  by  one 
or  perhaps  many  parties.  It  is  not  appropriate  to  say  that  these  models  are  predictive.  They  are 
more  like  weather  forecasts,  which  help  us  to  make  decisions,  but  are  rarely  100%  accurate  and 
are  sometimes  wrong.  To  help  deal  with  this  uncertainty,  weather  forecasts  are  continually  up¬ 
dated  and  changed  as  new  data  become  available  from  the  many  sensors  that  make  a  variety  of 
observations  in  many  locations.  Since  these  models  cannot  be  validated  formally,  the  appropriate 
concept  is  that  of  credibility.  Credibility  is  a  measure  of  trust  in  the  model  that  is  developed  over 
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time  through  successive  use  and  comparison  of  the  insights  developed  through  the  model  and  the 
occurrence  of  actual  events  and  resulting  effects. 


Figure  5.28:  Comparison  of  the  Effect  of  Different  Scenarios 

The  techniques  described  in  this  paper  can  make  an  important  contribution  to  a  variety  of 
communities  that  need  to  evaluate  complex  situations  to  help  make  decisions  about  actions  they 
may  take  to  achieve  effects  and  avoid  undesired  consequences.  The  approach  offers  at  least 
three  levels  of  analysis,  a  qualitative  evaluation  of  the  situation  based  on  the  graph  that  shows  the 
cause  and  effect  relationships  that  may  exist  in  the  environment,  and  two  levels  of  quantitative 
evaluation.  The  first  level  of  quantitative  analysis  is  static,  and  shows,  in  a  coarse  way,  what  the 
likelihood  of  different  effects  occurring  is  given  different  sets  of  actions.  The  second  quantita¬ 
tive  level  is  dynamic  and  shows  how  the  scenario  may  play  out  over  time.  The  relevant  aspect  is 
that  the  approach  allows  the  inclusion  of  diplomatic,  information,  military,  and  economic 
(DIME)  instruments  and  highlights  their  cumulative  effects. 

The  models  can  be  used  to  illustrate  areas  of  risk  including  undesired  effects,  and  risks  asso¬ 
ciated  with  the  amount  of  time  it  will  take  to  achieve  desired  effects.  It  should  also  be  noted  that 
these  models  are  not  likely  to  be  created  on  a  one  time  basis.  It  can  be  expected  that  the  under¬ 
standing  of  the  situation  will  continue  to  evolve  requiring  updates  or  even  new  models  to  be 
created.  Perhaps  the  best  contribution  is  that  the  technique  offers  a  standardized  way  to  analyze 
and  describe  very  complex  situations. 

During  the  ten  years  that  such  models  have  been  applied  to  different  domains  and  problems, 
a  number  of  lessons  have  been  noted. 

The  first  lesson  is  that  these  models  are  best  suited  to  addressing  issues  at  the  operation¬ 
al/strategic  level  and  are  unsuitable  for  the  tactical  level.  At  the  tactical  level,  we  need  to  expand 
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the  range  of  attrition-type  combat  models  to  include  the  influences  of  the  whole  spectrum  of  in¬ 
struments  of  national  power.  A  very  difficult  issue  is  the  determination  of  the  interactions  among 
the  various  instruments.  For  example,  what  is  the  effect  of  a  diplomatic  initiative  when  coupled 
with  information  operations  and  should  the  latter  precede,  be  concurrent  or  follow  the  former? 

The  second  lesson  is  that  consideration  of  temporal  issues  is  critical  to  the  understanding  of 
effects  based  operations  applied  to  transnational  terrorist  networks.  While  the  results  of  conven¬ 
tional  military  operations  focused  on  attrition  may  be  well  understood,  it  is  very  difficult  (not 
enough  data  yet)  to  estimate  how  some  of  the  non  military  actions  will  affect  the  future  recruit¬ 
ment  by  the  terrorist  organization.  Even  issues  such  as  persistence  are  not  well  understood  and, 
certainly,  not  quantified  yet. 

The  third  lesson  is  a  critical  one.  It  is  much  too  early  to  establish  general  purpose  TIN  mod¬ 
els  that  can  be  applied  to  different  circumstances  by  changing  the  contained  data.  It  is  not  even 
clear  that  this  is  a  desirable  approach  or  one  that  is  technically  sound  for  this  class  of  problems. 
Rather,  the  way  the  technology  and  the  tools  are  developing  is  to  provide  the  analysts  the  capa¬ 
bility  to  put  together  models  (in  a  given  domain  about  which  the  analyst  is  knowledgeable  and 
for  which  SMEs  are  available)  to  address  specific  issues  in  the  order  of  several  hours.  This  ap¬ 
proach  has  been  tried  successfully  at  the  Global  War  games  at  the  Naval  War  College  in  2000 
and  2001.  At  this  time,  the  state  of  the  art  has  taken  two  directions:  (a)  the  development  of  tem¬ 
plate  TINS  for  routine  analyses  and  (b)  the  extraction  directly  from  unstructured  data  using  on¬ 
tologies  draft  TINS  that  the  analyst  or  modeler  can  then  improve. 
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5.3  Enhanced  Influence  Nets  Case  Study 

Abbas  K.  Zaidi,  Faisal  Mansoor,  Titsa  P.  Papantoni-Kazakos,  Alexander  H.  Levis 

5.3.1  Introduction 

In  this  section,  we  apply  the  algorithms  developed  in  Chapter  3  to  an  illustrative  TIN.  We  also 
provide  a  comparison  of  the  latter  results  with  those  previously  obtained  via  the  use  of  the  CAST 
logic.  The  model  used  in  this  section  was  presented  by  Wagenhals  et  al.  in  2001  [18]  to  address 
the  following  scenario:  As  described  in  [18],  internal  political  instabilities  in  Indonesia  have  de¬ 
teriorated  and  ethnic  tensions  between  the  multiple  groups  that  comprise  Indonesia  have  in¬ 
creased.  Religion  has  been  a  major  factor  in  these  conflicts.  Members  of  one  of  the  minority 
(2%)  religious  groups  have  banded  together  to  combat  disenfranchisement.  These  members  have 
formed  a  rebel  militia  group.  Armed  conflicts  recently  occurred  between  those  rebels  and  the  In¬ 
donesian  military.  The  rebels  fled  to  eastern  Java  where  they  have  secured  an  enclave  of  land. 
This  has  resulted  in  a  large  number  of  Indonesian  citizens  being  within  the  rebel-secured  territo¬ 
ry.  Many  of  these  people  are  unsympathetic  to  the  rebels  and  are  considered  to  be  at  risk.  It  is 
feared  that  they  may  be  used  as  hostages  if  ongoing  negotiations  break  down  with  the  Indonesian 
government.  The  food  and  water  supply  and  sanitation  facilities  are  very  limited  within  the  rebel- 
secured  territory. 

Several  humanitarian  assistance  (HA)  organizations  are  on  the  island,  having  been  involved 
with  food  distribution  and  the  delivery  of  public  health  services  to  the  urban  poor  for  several 
years.  So  far,  the  rebels  have  not  prevented  HA  personnel  from  entering  the  territory  to  take  sup¬ 
plies  to  the  citizens.  The  U.S.  and  Australian  embassies  in  Jakarta  are  closely  monitoring  the  sit¬ 
uation  for  any  indications  of  increasing  rebel  activity.  In  addition,  Thailand,  which  has  sent  sev¬ 
eral  hundred  citizens  to  staff  numerous  capital  investment  projects  on  Java,  is  known  to  be  close¬ 
ly  monitoring  the  situation. 

5.3.2  Modeling 

To  reflect  the  situation  stated  above,  a  TIN  was  first  created  in  [18]  and  is  shown  in  Fig.  5.29. 
This  TIN  models  the  causal  and  influencing  relationships  between  (external)  affecting  events  (on 
the  left  side  and  along  the  top  of  the  model  in  Fig.  5.29)  and  the  overall  effect  of  concern  which 
is  the  single  node  with  no  parents  on  the  right-hand  side  of  the  model.  In  this  case,  the  effect  is 
“Rebels  decide  to  avoid  violence”.  The  actionable  (external)  events  in  this  model  include  a  com¬ 
bination  of  potential  coalition,  UN,  and  rebel  actions.  The  coalition  actions  include  actions  by 
the  US  government,  its  military  instrument  of  national  power,  actions  by  the  Government  of  In¬ 
donesia,  and  actions  by  Thailand. 

For  purposes  of  illustration  and  comparison  of  results,  we  have  selected  a  part  of  this  net¬ 
work,  as  shown  in  Fig.  5.30. 

The  (external)  affecting  events  in  the  TIN  of  Fig.  5.30  are  drawn  as  root  nodes  (nodes  with¬ 
out  incoming  edges).  The  text  in  each  node,  e.g.,  “1 — Coalition  Deploys  Forces  to  Indonesia,” 
represents  a  node  ID  and  a  statement  describing  the  binary  proposition.  In  Fig.  5.30,  {A^}o  <i  <4 

represents  the  set  of  the  external  affecting  events,  where  the  index  ‘i’  depicts  the  node  ID.  The 
marginal  probabilities  for  the  external  affecting  events  are  also  shown  inside  each  node.  In  this 
illustration,  we  assume  all  external  affecting  events  to  be  mutually  independent  (Section  3.4.) 
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Fig.  5.29  Timed  Influence  Net  of  East  Timor  Situation  [18] 

A  desired  effect,  or  an  objective  which  a  decision  maker  is  interested  in,  is  modeled  as  a  leaf 
node  (node  without  outgoing  edges).  The  node  with  ID  ‘10’  in  Fig.  5.30  represents  the  objective 
for  the  illustration.  In  both  Figs.  5.29  and  5.30,  the  root  nodes  are  drawn  as  rectangles  while  the 
non-root  nodes  are  drawn  as  rounded  rectangles.  A  directed  edge  with  an  arrowhead  between 
two  nodes  shows  the  parent  node  promoting  the  chances  of  a  child  node  being  true,  while  the 
roundhead  edge  shows  the  parent  node  inhibiting  the  chances  of  a  child  node  being  true.  The  first 
two  elements  in  the  inscription  associated  with  each  arc  quantify  the  corresponding  strengths  of 
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the  influence  of  a  parent  node’s  state  (as  being  either  true  or  false)  on  its  child  node.  The  third 
element  in  the  inscription  depicts  the  time  it  takes  for  a  parent  node  to  influence  a  child  node.  For 
instance,  in  Fig.  5.30,  event  “1 — Coalition  Deploys  Forces  to  Indonesia”  influences  the  occur¬ 
rence  of  event  “7 — Coalition  Secures  APOD  and  SPOD”  after  3  time  units. 
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Fig.  5.30  Sample  TIN  for  Analysis 

The  purpose  of  building  a  TIN  is  to  evaluate  and  compare  the  performances  of  alternative 
courses  of  actions  described  by  the  set  Aj  in  the  definition  of  TINs.  The  impact  of  a  selected 
course  of  action  on  the  desired  effect  is  analyzed  with  the  help  of  a  probability  profile.  The  fol¬ 
lowing  is  an  illustration  of  such  an  analysis  with  the  help  of  two  COAs,  given  below: 

CQAl.'  All  external  affecting  events  are  taken  simultaneously  at  time  1  and  are  mutually  inde¬ 
pendent. 

COA2:  Events  {0,  2,  4}  are  taken  at  time  1,  simultaneously,  and  events  {1,3}  are  taken  at  time 
2,  simultaneously. 

The  two  COAs  can  also  be  described  as  in  Table  5.5. 


TABLE  5.5  The  two  Courses  of  Action 


Event 

COAl 

COA2 

Time 

Status 

Time 

Status 

0  —  Rebels  Underestimate  the  Strength  of  Coalition 
Power 

1 

1 

(=  True) 

1 

1 

1  —  Coalition  Deploys  Forces  to  Indonesia 

1 

1 

2 

1 

2  —  Thai  can  Conduct  Unilateral  NEO 

1 

1 

1 

1 

3  —  Coalition  PSYOP  can  Counter  Rebel  Propaganda 

1 

1 

2 

1 

4  —  Rebels  Overestimate  their  Strength 

1 

1 

1 

1 
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Note  that  the  simultaneous  oeeurrenee  of  external  affeeting  events  does  not  neeessarily  imply 
simultaneous  revealing  of  their  status  on  an  affeeted  node;  the  time  sequenee  of  revealed  affeet¬ 
ing  events  is  determined  by  both  the  time  stamp  on  eaeh  affeeting  event  and  the  delays  on  edges. 
Beeause  of  the  propagation  delay  assoeiated  with  eaeh  edge,  influenees  of  aetions  impaet  the  af¬ 
feeted  event  progressively  in  time.  As  a  result,  the  probability  of  the  affeeted  event  ehanges  as 
time  evolves.  A  probability  profile  draws  these  probabilities  against  the  eorresponding  time  line. 
In  Fig.  5.31,  probability  profiles  generated  for  nodes  “9 — Rebels  Believe  Coalition  has  the  Mili¬ 
tary  Power  to  Stop  Them”  and  “10 — Rebels  Believe  they  are  in  Control  of  Events,”  using  the 
CAST  logie  based  approaeh  in  [4,  5,  13,  15,  17]  are  shown. 
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Fig.  5.31  Probability  Profiles  Generated  by  the  CAST  Logic  Approach 


For  the  same  TIN  model  as  in  Fig.  5.30  and  the  corresponding  course  of  actions,  we  used  the 
approach  presented  in  this  paper  and  produced  pertinent  results  for  the  following  two  cases: 

Case  I 

For  this  illustration,  we  utilize  the  influence  constant  model  presented  in  section  3.8.  A  and  the 
temporal  case  presented  in  section  3.6.  The  influence  constants  {/?.(x")}i  < .  <  « - 1  are  first  pre¬ 
computed  via  the  dynamic  programming  expression  in  Lemma  3.2,  section  3.3.  The  resulting 
probability  profiles  for  the  two  affected  events/propositions  in  the  TIN  are  shown  in  Fig.  5.32. 
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Fig.  5.32  Probability  Profiles  for  Case  I 


Case  II 


For  this  illustration,  we  utilize  the  influence  constant  model  presented  in  section  3.8.  A  and 
the  temporal  case  where  the  existence  of  an  affecting  event  is  assumed  unknown  to  an  af¬ 
fected  event  unless  it  reveals  itself  and  makes  its  status  known  to  the  affected  event.  The 
conditional  probabilities,  in  this  case,  are  computed  real-time  by  eq.  (3.33).  The  resulting 
probability  profiles  for  the  two  affected  events/propositions  in  the  TIN  are  shown  in  Fig. 
5.33. 


Comparing  Figs.  5.31  and  5.32,  we  note  that  when  the  existence  of  all  the  external  affect¬ 
ing  events  are  initially  known,  then  the  approach  in  this  paper  produces  results  that  are  more 
accurate  and  consistent  than  those  produced  by  the  CAST  logic  based  approach.  This  was 
expected,  since  the  present  approach  has  eliminated  the  inconsistencies  that  the  CAST  logic 
based  approach  suffers  from.  Unlike  the  CAST  logic  based  approach,  the  probability  profiles 
generated  by  the  new  approach  only  record  the  posterior  probabilities  resulting  from  the  im¬ 
pacts  of  the  external  affecting  events  and  do  not  assume  any  default  initial  values;  in  profiles 
of  Figs.  5.31  and  5.32  the  first  impact  is  recorded  at  time  ‘3’.  Comparing  Figs.  5.32  and 
5.33,  we  note  that,  as  expected,  when  the  existence  of  the  external  affecting  events  are  re¬ 
vealed  sequentially  in  time  then,  there  is  a  relatively  high  level  of  instability  in  time  evolu¬ 
tion,  as  compared  to  the  case  where  the  existence  of  all  the  external  affecting  events  is  in¬ 
itially  known.  The  selection  of  a  influence  constant  and  of  temporal  models  for  a  TIN  under 
construction/analysis  is  a  design  issue  and  is  reflected  by  the  differences  in  the  resulting 
probability  profiles. 
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Fig.  5.33.  Probability  Profiles  for  Case  II 


5.4  Conclusion 

In  this  chapter,  several  applications  were  presented.  The  first  one  dealt  with  the  analysis  of 
the  data  regarding  the  placement  and  effect  of  lEDs  in  the  Diyala  province  of  Iraq.  The 
second  case,  illustrated  the  application  of  Timed  Influence  nets  to  the  development  and  eval¬ 
uation  of  potential  Courses  of  Action  for  suppressing  lEDs  in  Diyala.  The  thirds  case  illu¬ 
strated  how  the  expanded  theory  of  Influence  Nets  relaxes  the  assumptions  regarding  causali¬ 
ty  while  producing  the  same  results  with  the  original  model  when  the  restrictive  assumptions 
apply. 
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Chapter  6 


Computationally  Derived  Models  of  Adversary  Organizations 

Ashraf  M.  AbuSharekh,  Smriti  K.  Kansal,  A.  Erkin  Olmez,  and  Alexander  H.  Levis 


6.1  Introduction 

The  effort  to  model  organizational  behavior  with  mathematieal  models  has  a  long  history.  The 
groundbreaking  work  of  Marshak  &  Radnor  [43]  looked  at  the  communications  between  organi¬ 
zation  members;  today  we  would  call  this  cormectivity  and  associated  information  flows.  Dre- 
nick  [44]  proposed  a  mathematical  theory  of  organization  in  which  a  number  of  fundamental  sys¬ 
tem  theoretic  ideas  were  exploited  to  draw  insights  for  the  design  of  organizations  consisting  of 
members  who  process  tasks  under  time  constraints  -  a  form  of  Simon’s  [45]  bounded  rationality. 
Levis  [46]  and  his  students  developed  a  discrete  event  dynamical  model  and  a  set  of  rules  that 
governed  the  allowed  interactions  -  whether  they  represented  forms  of  information  sharing  or  of 
commands.  This  model,  expressed  mathematically  in  the  language  of  Colored  Petri  Nets  [47], 
allowed  the  design  of  organizational  architectures  that  could  meet  accuracy  and  timeliness  con¬ 
straints  while  not  exceeding  the  workload  limitations  of  the  decision  makers.  Essentially,  the  or¬ 
ganization  members  conducted  information  processing  and  decision  making  tasks,  often  sup¬ 
ported  by  decision  support  systems  in  order  to  reduce  workload,  while  increasing  accuracy  and 
timeliness  of  the  organizational  response  [48]. 

The  basic  model  of  the  single  decision  maker  evolved  over  time  in  order  to  accommodate 
more  complex  interactions  and  allow  for  different  types  of  internal  processing  by  the  organiza¬ 
tion  members  [49].  The  early  focus  was  on  small  teams  in  which  several  members  needed  to  be 
organized  to  perform  a  demanding,  time-sensitive  task.  The  objective  was  to  achieve  organiza¬ 
tional  performance  without  causing  excessive  workload  that  would  lead  to  performance  degrada¬ 
tion. 

A  key  objective,  relating  structure  to  behavior,  meant  that  the  structure  and  attributes  of  the 
simulation  models  must  be  traceable,  in  a  formal  way,  to  the  architecture  design.  Hence  the  use 
of  the  term  “executable”  model  which  denotes  that  there  is  a  formal  mathematical  model  used  for 
simulation  with  characteristics  that  are  traceable  to  the  static  designs.  The  mathematical  model 
can  also  be  used  for  analysis,  i.e.,  properties  of  the  model  and  performance  characteristics  can  be 
determined  from  the  mathematical  description.  A  wealth  of  theoretical  results  on  discrete  event 
dynamical  systems,  in  general,  and  Colored  Petri  nets,  in  particular,  can  be  applied  to  the  execut¬ 
able  model. 

More  recently,  the  problem  of  modeling  adversary  organizations  about  which  we  may  have 
limited  information  has  received  renewed  attention.  Adversaries  may  have  differences  in  equip¬ 
ment  or  materiel,  differences  in  command  structures,  differences  in  constraints  under  which  they 
can  operate,  and,  last  but  not  least,  differences  in  culture.  The  differences  in  equipment  and  in 
operational  constraints  can  be  handled  easily  in  the  existing  modeling  framework.  Differences  in 
command  structures  require  some  additional  work  to  express  these  differences  in  structural  and 
quantitative  ways.  The  real  challenge  is  how  to  express  cultural  differences  in  these,  primarily 
mechanistic,  models  of  organizations. 
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Other  considerations  that  drive  the  design  problem  are  the  tempo  of  operations  and  whether 
the  adversary  has  an  explicit  organization,  as  a  military  force  would  have,  or  an  implicit  one,  as  a 
loosely  coupled  terrorist  organization  may  have.  This  work  focuses  on  the  ability  to  introduce 
attributes  that  characterize  cultural  differences  into  the  mechanistic  model  for  organization  de¬ 
sign  and  use  simulation  to  see  whether  these  parameters  result  in  significant  changes  in  structure. 
The  objective,  therefore,  is  to  relate  performance  to  structural  features  but  add  attributes  that  cha¬ 
racterize  cultural  differences.  Specifically,  the  attributes  or  dimensions  defined  by  Hofstede  [50] 
are  introduced  in  the  design  process  in  the  form  of  constraints  on  the  allowable  interactions  with¬ 
in  the  organization. 

In  sections  6.2  and  6.3,  the  modeling  approach  is  described  briefly  since  it  has  been  docu¬ 
mented  extensively  in  the  literature.  In  sections  6.4  and  6.5,  the  Hofstede  dimensions  are  intro¬ 
duced  and  then  applied  to  the  organization  design  algorithm.  In  sections  6.6  and  6.7,  two  illustra¬ 
tive  examples  are  presented  -  one  focuses  on  the  design  of  adversary  organizations  and  one  on 
coalition  organizations.  In  the  final  section,  6.8,  advantages  and  shortcomings  of  this  approach 
are  discussed. 

6.2  The  Decision  Maker  Model  And  Organizational  Design 

The  five-stage  interacting  decision  maker  model  [49]  had  its  roots  in  the  investigation  of  tactical 
decision  making  in  a  distributed  environment  with  efforts  to  understand  cognitive  workload,  task 
allocation,  and  decision  making.  The  five-stage  model  allows  the  algorithm  in  each  stage  to  be 
defined  and  makes  explicit  the  input  and  output  interactions  of  the  decision  maker  with  other  or¬ 
ganization  members  or  the  external  environment.  It  also  has  a  well-defined  algorithm  for  charac¬ 
terizing  workload.  This  model  has  been  used  for  fixed  as  well  as  variable  structure  organizations 
[51]. 

The  five-stage  decision  maker  (DM)  model  is  shown  in  Fig.  6.1.  The  DM  receives  signals 
from  the  external  environment  or  from  another  decision  maker.  The  Situation  Assessment  (SA) 
stage  represents  the  processing  of  the  incoming  signal  to  obtain  the  assessed  situation  that  may 
be  shared  with  other  DMs.  The  decision  maker  can  also  receive  situation  assessment  signals 
from  other  decision  makers  within  the  organization;  these  signals  are  then  fused  together  in  the 
Information  Fusion  (IF)  stage  to  produce  the  fused  situation  assessment.  The  fused  information  is 
then  processed  at  the  Task  Processing  (TP)  stage  to  produce  a  signal  that  contains  the  task  infor¬ 
mation  necessary  to  select  a  response.  Command  input  from  superiors  is  also  received.  The 
Command  Interpretation  (Cl)  stage  then  combines  internal  and  external  guidance  to  produce  the 
input  to  the  Response  Selection  (RS)  stage.  The  RS  stage  then  produces  the  output  to  the  envi¬ 
ronment  or  to  other  organization  members. 

Information  Command 


Sharing  Sharing 

Fig.  6. 1  Model  of  the  Five-Stage  Decision  Maker 

The  key  feature  of  the  model  is  the  explicit  depiction  of  the  interactions  with  other  organiza¬ 
tion  members  and  the  environment.  These  interactions  follow  a  set  of  rules  designed  to  avoid 
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deadlock  in  the  information  flow.  A  decision  maker  can  receive  inputs  from  the  external  envi¬ 
ronment  only  at  the  SA  stage.  However,  this  input  can  also  be  another  decision  maker's  output.  A 
decision  maker  can  share  his  assessed  input  with  another  organization  member;  this  is  depicted 
as  an  input  to  the  IF  stage  when  the  decision  maker  is  receiving  a  second  input.  This  input  must 
be  generated  from  another  decision  maker  and  can  be  the  output  of  the  SA  or  RS  stage.  In  the  Cl 
stage,  the  decision  maker  can  receive  commands.  This  is  also  internally  generated  and  must  ori¬ 
ginate  from  another  decision  maker's  RS  stage.  Thus  the  interactions  between  two  decision  mak¬ 
ers  are  limited  by  the  constraints  enumerated  above:  the  output  from  the  SA  stage,  can  only  be  an 
internal  input  to  another  decision  maker's  IF  stage,  and  an  internal  output  from  the  RS  stage  can 
only  be  input  to  another  decision  maker's  SA  stage,  IF  stage,  or  Cl  stage. 

The  mathematical  representation  of  the  interactions  between  DMs  is  based  on  the  connector 
labels  Bi,  Si,  Fij,  Gy,  Hy  and  Cy  of  Fig.  6.2;  they  are  integer  variables  taking  values  in  {0,  1} 
where  1  indicates  that  the  corresponding  directed  link  is  actually  present  in  the  organization, 
while  0  reflects  the  absence  of  the  link.  These  variables  can  be  aggregated  into  two  vectors  e  and 
s,  and  four  matrices  F,  G,  H  and  C.  The  interaction  structure  of  an  n-decision-maker  organiza¬ 
tion  may  be  represented  by  the  following  six  arrays:  two  n  x  1  vectors  e  and  s,  representing  the 
interactions  between  the  external  environment  and  the  organization: 

e  =  [ei],  s  =  [si]  for  i  1, 2,  ...,  n 


and  four  n  x  n  matrices  F,  G,  H  and  C  representing  the  interactions  between  decision  makers  in¬ 
side  the  organization.  Since  there  are  four  possible  links  between  any  two  different  DMs,  the 
maximum  number  of  interconnecting  links  that  an  n  decision-  maker  organization  can  have  is 

kmax  “4n  -2n 

jj 

Consequently,  if  no  other  considerations  were  taken  into  account,  there  could  be  2  alter¬ 
native  organizational  forms.  This  is  a  very  large  number:  290  for  a  five-person  organization. 


.SA  _IF  _TP  Cl  _RS  s. 

-hofo+o-t^ 
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Fig.  6.2  One-sided  Interactions  Between  Decision  Maker  i  and  Decision  Maker  j 

In  the  Petri  net  representation  of  the  DM  model,  the  transitions  stand  for  the  algorithms,  the 
connectors  for  the  precedence  relations  between  these  algorithms,  and  tokens  for  the  messages 
that  flow  between  the  DMs.  If  the  tokens  need  to  be  distinct,  i.e.,  carry  information,  then  a  Co¬ 
lored  Petri  net  representation  is  used.  Other  organization  components  can  be  modeled  using  the 
same  basic  five-stage  model,  but  eliminating  one  or  more  of  the  stages.  For  example,  a  processor 
that  receives  sensor  data  and  converts  it  to  an  estimate  of  a  vector  variable  can  be  modeled  by  a 
single  SA  transition,  while  a  data  fusion  algorithm  can  be  modeled  by  an  IF  transition.  With  this 
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model  of  the  organization  member  and  its  variants  used  to  model  other  components,  it  is  now 
possible  to  formulate  the  problem  of  designing  decision-making  organizations. 

6.3.  The  Lattice  Algorithm 

The  analytical  description  of  the  possible  interactions  between  organization  members  forms  the 
basis  for  an  algorithm  that  generates  all  the  architectures  that  meet  some  structural  constraints  as 
well  as  application-specific  constraints  that  may  be  present.  The  set  of  structural  constraints  rules 
out  a  large  number  of  architectures.  The  most  important  constraint  addresses  the  connectivity  of 
the  organization  -  it  eliminates  information  structures  that  do  not  represent  a  single  integrated 
organization.  Remy  and  Levis  [52]  developed  an  algorithm,  named  the  Lattice  algorithm,  that 
determines  the  maximal  and  minimal  elements  of  the  set  of  designs  that  satisfy  all  the  con¬ 
straints;  the  entire  set  can  then  be  generated  from  its  boundaries.  The  algorithm  is  based  on  the 
notion  of  a  simple  path  -  a  directed  path  without  loops  from  the  source  to  the  sink.  Feasible  ar¬ 
chitectures  are  obtained  as  unions  of  simple  paths.  Consequently,  they  constitute  a  partially  or¬ 
dered  set.  The  algorithm  receives  as  input  the  matrix  tuple  {e,  s,  F,  G,  H,  C}  of  dimension  n, 
where  n  is  the  number  of  organization  members. 

There  are  some  structures  corresponding  to  combinations  of  interactions  between  compo¬ 
nents  that  do  not  have  a  physical  interpretation;  e.g.,  DMs  can  exchange  information  -  Fy  and  Fji 
can  coexist  -  but  commands  are  unilateral-  either  Cij  or  Cji  or  none,  but  not  both.  Those  structures 
should  be  eliminated,  if  realistic  organizational  forms  are  to  be  generated.  The  structural  con¬ 
straints  define  what  kinds  of  combinations  of  interactions  need  to  be  ruled  out.  A  set  of  four  dif¬ 
ferent  structural  constraints  is  formulated  that  applies  to  all  organizational  structures  being  con¬ 
sidered. 

R1  A  directed  path  should  exist  from  the  source  to  every  node  of  the  structure  and  from 
every  node  to  the  sink. 

R2  The  structure  should  have  no  loops;  i.e.,  the  organizational  structures  should  be  acyclical. 

R3  There  can  be  at  most  one  link  from  the  RS  stage  of  a  DM  to  each  one  of  the  other  DMs; 
i.e.,  for  each  i  and  j,  only  one  element  of  the  triplet  {Gy,  Hy,  Cy}  can  be  nonzero. 

R4  Information  fusion  can  take  place  only  at  the  IF  and  Cl  stages.  Consequently,  the  SA  and 
RS  stages  of  each  DM  can  have  only  one  input. 

Constraint  R1  eliminates  structures  that  do  not  represent  a  single  integrated  organization  and 
ensures  that  the  flow  of  information  is  continuous  within  an  organization.  Constraint  R2,  allows 
acyclical  organizations  only'.  Constraint  R3  states  that  the  output  of  the  RS  stage  of  one  DM  or 
component  can  be  transmitted  to  another  DM  or  component  only  once:  it  does  not  make  much 
sense  to  send  the  same  information  to  the  same  decision  maker  at  several  different  stages.  Con¬ 
straint  R4  prevents  a  decision  maker  from  receiving  more  than  one  input  at  the  SA  stage.  The 
rationale  behind  this  limitation  is  that  information  cannot  be  merged  at  the  SA  stage;  the  IF  stage 
has  been  specifically  introduced  to  perform  such  a  fusion. 


This  restriction  is  made  to  avoid  deadlock  and  circulation  of  messages  within  the  organization. 
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Any  realistic  design  procedure  should  allow  the  designer  to  introduce  specific  structural  cha¬ 
racteristics  appropriate  to  the  particular  design  problem.  To  introduce  user-defined  constraints 
that  will  reflect  the  specific  application  the  organization  designer  is  considering,  appropriate  Os 
and  Is  can  be  placed  in  the  arrays  {e,  s,  F,  G,  H,  C.  The  other  elements  will  remain  unspecified 
and  will  constitute  the  degrees  of  freedom  of  the  design.  The  complete  set  of  constraints  is  de¬ 
noted  by  R. 

A  feasible  structure  is  one  that  satisfies  both  the  structural  and  the  user-defined  constraints. 
The  design  problem  is  to  determine  the  set  of  all  feasible  structures  corresponding  to  a  specific 
set  of  constraints.  Note  that  this  approach  is  not,  by  design,  concerned  with  the  optimal  organiza¬ 
tional  structure,  but  with  the  design  of  a  whole  family  of  feasible  structures.  At  this  stage,  we  are 
only  concerned  with  the  structure  and  information  flows,  i.e.,  the  development  of  the  set  of  feas¬ 
ible  organizational  forms.  This  set  will  become  the  admissible  set  in  the  problem  of  incorporat¬ 
ing  cultural  constraints. 

The  notion  of  subnet  defines  an  order  (denoted  <)  on  the  set  of  all  well  defined  nets  of  di¬ 
mension  n.  The  concepts  of  maximal  and  minimal  elements  can  therefore  be  defined.  A  maximal 
element  of  the  set  of  all  feasible  structures  is  called  a  maximally  connected  organization 
(MAXO).  Similarly,  a  minimal  element  is  called  a  minimally  connected  organization  (MINO). 
Maximally  and  minimally  connected  organizations  can  be  interpreted  as  follows.  A  MAXO  is  a 
well  defined  net  such  that  it  is  not  possible  to  add  a  single  link  without  violating  the  set  of  con¬ 
straints  R.  Similarly,  a  MINO  is  a  well  defined  net  such  that  it  is  not  possible  to  remove  a  single 
link  without  violating  the  set  of  constraints  R.  The  following  proposition  is  a  direct  consequence 
of  the  definition  of  maximal  and  minimal  elements:  For  any  given  feasible  structure  P,  there  is  at 
least  one  MINO  Pmin  and  one  MAXO  Pmax  such  that  Pmin  <  P  <  Pmax.  Note  that  the  net  P 
need  not  be  a  feasible.  There  is  indeed  no  guarantee  that  a  well-defined  net  located  between  a 
MAXO  and  a  MINO  will  fulfill  the  constraints  R,  since  such  a  net  need  not  be  connected.  To 
address  this  problem,  the  concept  of  a  simple  path  is  used. 

The  following  proposition  characterizes  the  set  of  all  feasible  organizational  structures:  P  is  a 
feasible  structure  if  and  only  if  P  is  a  union  of  simple  paths,  i.e.,  P  is  bounded  by  at  least  one 
MINO  and  one  MAXO.  Note  that  in  this  approach  the  incremental  unit  leading  from  a  feasible 
structure  to  its  immediate  super-ordinate  is  a  simple  path  and  not  an  individual  link.  In  generat¬ 
ing  organizational  structures  with  simple  paths,  the  connectivity  constraint  R1  is  automatically 
satisfied. 

The  Lattice  algorithm  generates,  once  the  set  of  constraints  R  is  specified,  the  MINOs  and 
the  MAXOs  that  characterize  the  set  of  all  organizational  structures  that  satisfy  the  designer's 
requirements.  The  next  step  of  the  analysis  consists  of  putting  the  MINOs  and  the  MAXOs  in 
their  actual  context  to  give  them  a  physical  instantiation.  If  the  organization  designer  is  interested 
in  a  particular  (MINO,  MAXO)  pair  because  it  contains  interactions  that  are  deemed  desirable 
for  the  specific  application,  he  can  further  investigate  the  intermediate  nets  by  considering  the 
chain  of  nets  that  is  obtained  by  adding  simple  paths  to  the  MINO  until  the  MAXO  is  reached. 

This  methodology  provides  the  designer  of  organizational  structures  with  a  rational  way  to 
handle  a  problem  whose  combinatorial  complexity  is  very  large.  Having  developed  a  set  of  orga¬ 
nizational  structures  that  meets  the  set  of  logical  constraints  and  is,  by  construction,  free  of  struc¬ 
tural  problems,  we  can  now  address  the  problem  of  incorporating  attributes  that  characterize  cul¬ 
tures. 
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6.4.  Modeling  Cultural  Attributes 

Hofstede  [50]  distinguishes  dimensions  of  culture  that  can  be  used  as  an  instrument  to  make 
comparisons  between  cultures  and  to  cluster  cultures  according  to  behavioral  characteristics. 
Culture  is  not  a  characteristic  of  individuals;  it  encompasses  a  number  of  people  who  have  been 
conditioned  by  the  same  education  and  life  experience.  Culture,  whether  it  is  based  on  nationality 
or  group  membership  such  as  the  military,  is  what  the  individual  members  of  a  group  have  in 
common  [53]. 

To  compare  cultures,  Hofstede  originally  differentiated  them  according  to  four  dimensions: 
uncertainty  avoidance  (UAl),  power  distance  (PDI),  masculinity-femininity  (MAS),  and  indivi¬ 
dualism-collectivism  (IND).  The  dimensions  were  measured  on  an  index  scale  from  0  to  100,  al¬ 
though  some  countries  may  have  a  score  below  0  or  above  100  because  they  were  measured  after 
the  original  scale  was  defined  in  the  70’s.  The  original  data  were  from  an  extensive  IBM  data¬ 
base  for  which  1 16,000  questionnaires  were  used  in  72  countries  and  in  20  languages  over  a  six- 
year  period.  The  hypothesis  here  is  that  these  dimensions  may  affect  the  interconnections  be¬ 
tween  decision  makers  working  together  in  an  organization. 

The  power  distance  dimension  can  be  defined  as  "the  extent  to  which  less  powerful  members 
of  a  society  accept  and  expect  that  power  is  distributed  unequally"  [50].  An  organization  with  a 
high  power  distance  value  will  likely  have  many  levels  in  its  hierarchy  and  convey  decisions 
from  the  top  of  the  command  structure  to  personnel  lower  in  the  command  structure;  centralized 
decision  making.  Organizations  with  low  power  distance  values  are  likely  to  have  decentralized 
decision  making  characterized  by  a  flatter  organizational  structure;  personnel  at  all  levels  can 
make  decisions  when  unexpected  events  occur  with  no  time  for  additional  input  from  above. 

Uncertainty  avoidance  can  be  defined  as  "the  extent  to  which  people  feel  threatened  by  un¬ 
certainty  and  ambiguity  and  try  to  avoid  these  situations"[50].  An  organization  which  scores  high 
on  un-  certainty  avoidance  will  have  standardized  and  formal  procedures;  clearly  defined  rules 
are  preferred  to  unstructured  situations.  In  organizations  with  low  scores  on  uncertainty  avoid¬ 
ance,  procedures  will  be  less  formal  and  plans  will  be  continually  reassessed  for  needed  modifi¬ 
cations.  Klein  et  al.  [54]  hypothesized  that  during  complex  operations,  it  may  not  be  possible  to 
specify  all  possible  contingencies  in  advance  and  to  take  into  account  all  complicating  factors. 

The  trade-off  between  time  and  accuracy  can  be  used  to  study  the  affect  of  both  power  dis¬ 
tance  and  uncertainty  avoidance  in  the  model  [55].  Messages  exchanged  between  decision  mak¬ 
ers  can  be  classified  according  to  three  different  message  types:  information,  control,  and  com¬ 
mand  ones  [56].  Information  messages  include  inputs,  outputs,  and  data;  control  messages  are 
the  enabling  signals  for  the  initiation  of  a  subtask;  and  command  messages  affect  the  choice  of 
subtask  or  of  response.  The  messages  exchanged  between  decision  makers  can  be  classified  ac¬ 
cording  to  these  different  types  and  each  message  type  can  be  associated  with  a  subjective  para¬ 
meter.  For  example,  uncertainty  avoidance  can  be  associated  with  control  signals  that  are  used  to 
initiate  subtasks  according  to  a  standard  operating  procedure.  A  decision  maker  with  high  uncer¬ 
tainty  avoidance  is  likely  to  follow  the  procedure  regardless  of  circumstances,  while  a  decision 
maker  with  low  uncertainty  avoidance  may  be  more  innovative.  Power  distance  can  be  asso¬ 
ciated  with  command  signals.  A  command  center  with  a  high  power  distance  value  will  respond 
promptly  to  a  command  signal,  while  in  a  command  center  with  a  low  power  distance  value  this 
signal  may  not  always  be  acted  on  or  be  present. 
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6.5  Using  Cultural  Constraints 

Cultural  constraints  help  a  designer  determine  classes  of  similar  feasible  organizations  by  setting 
specific  conditions  that  limit  the  number  of  various  types  of  interactions  between  decision  mak¬ 
ers.  Cultural  constraints  are  simply  represented  as  interactional  constraint  statements.  Four  types 
of  interactions  have  previously  been  defined  (information  sharing  represented  by  matrix  F,  con¬ 
trol  represented  by  matrix  G,  result  sharing  represented  by  matrix  H,  and  command  represented 
by  matrix  C).  The  upper  bounds,  lower  bounds  and  constants  of  an  interactional  constraint 
statement  can  take  a  value  between  0  or  the  number  of  fixed-type  interactions  allowed  by  user- 
defined  requirements  (whichever  is  higher)  and  the  maximum  number  of  interactions  allowed  by 
user-defined  requirements  for  a  given  problem,  and  are  formulated  using  a  group’s  cultural 
score.  An  approach  for  determining  the  values  of  these  constraints  has  been  developed  by  Olmez 
[57].  The  constraints  are  obtained  using  a  linear  regression  on  the  four  dimensions  to  determine 
the  change  in  the  range  of  the  number  of  each  type  of  interaction  that  is  allowed. 

dY=c  +  a(PDI)  +  ^(UAI)  +  j(MAS)  +  5  (IND) 
where  Y  is  #F  or  #G  or  #H  or  #C 
Example: 

#F<2,  #G  =  0,  1<#H<3,  #C  =  3 

The  methodology  to  obtain  the  solution  space  given  a  set  of  user-defined  constraints  and  cul¬ 
tural  constraints  using  an  extended  lattice  algorithm  called  C-Lattice  is  presented  next. 

C-Lattice  Algorithm:  The  Lattice  Algorithm  allows  the  automatic  generation  of  candidate 
structures  based  on  a  set  of  user  and  structural  constraints.  If  the  cultural  constraints  can  be  in¬ 
cluded  in  the  problem  statement  in  a  manner  similar  to  the  structural  constraints,  then  the  lattice 
structure  of  the  solution  space  will  be  preserved  and  an  extended  version  of  the  Lattice  algorithm 
may  be  used  to  generate  structures  that  satisfy  the  additional  cultural  attributes.  Since  the  cultural 
constraints  impose  limits  on  the  number  of  interactions  between  the  decision  makers,  they  are 
placing  additional  structural  constraints  on  the  solution  space.  Hence  the  constraints  R1  to  R4 
specified  in  [52]  can  be  extended  to  include  the  cultural  constraints  R5  to  R8.  For  example,  for 
the  cultural  constraint  statement  give  earlier,  they  become: 

•  R5:  The  number  of  F  type  interactions  must  be  between  0  and  2 

•  R6:  The  number  of  G  type  interactions  must  equal  0 

•  R7:  The  number  of  H  type  interactions  must  lie  between  1  and  3 

•  R8:  The  number  of  C  type  interactions  must  equal  3. 

The  flowchart  in  Fig.  6.3  explains  the  generation  of  the  culturally  constrained  solution  space. 
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Fig.  6.3  Flowchart  for  culturally  constrained  solution  space 

MAXOs  and  MfNOs  are  generated  using  the  same  algorithm  described  in  [52].  The  “Build 
Lattices”  step  checks  if  a  MINO  is  contained  within  a  MAXO.  If  it  is,  then  the  MINO  is  con¬ 
nected  to  that  MAXO  and  forms  a  lattice.  For  each  lattice  in  the  solution  space,  we  check  the 
MINO  to  see  if  it  violates  the  cultural  boundaries.  For  example,  if  the  number  of  F  type  interac¬ 
tions  in  the  MfNO  is  two  and  the  maximum  allowable  by  the  cultural  constraints  is  only  one, 
then  the  MINO  does  not  satisfy  the  cultural  attributes  and  since  the  MINO  is  the  minimally  con¬ 
nected  structure  in  that  lattice,  no  other  structure  will  satisfy  the  constraints.  Hence  the  lattice  can 
be  discarded.  If  the  MINO  does  pass  the  boundary  test,  then  simple  paths  are  added  to  it  to  satis¬ 
fy  the  cultural  constraints  R5  to  R8.  The  corresponding  minimally  connected  organization(s)  is 
now  called  the  C-MINO(s)  (culturally  bound  MINO).  Similarly,  by  subtracting  simple  paths 
from  the  MAXO,  C-MAXO(s)  can  be  reached.  The  step  “Build  C-Lattices”  connects  the  C- 
MINOs  to  the  C-MAXOs.  The  advantage  of  using  this  approach  is  that  the  designer  does  not 
have  to  know  the  cultural  attributes  at  the  start  of  the  analysis.  He  can  add  them  at  a  later  stage. 
This  also  enables  him  to  study  the  same  organization  structure  under  different  cultures.  Also  pre- 
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viously  designed  organization  structures  can  now  be  analyzed  in  new  light  using  cultural 
attributes. 

6.6  Adversarial  Modeling  Using  CAESAR  III 

The  design  approach  and  the  algorithm  are  illustrated  using  a  hypothetical  example  of  an  adver¬ 
sarial  organization.  The  simulations  were  performed  using  a  new  application  called  CAESAR  III 
developed  in  System  Architectures  Lab  at  GMU.  CAESAR  III  is  used  for  the  design  of  informa¬ 
tion  processing  and  decision  making  organizations  at  the  operational  and  tactical  levels;  it  takes 
into  consideration  cultural  differences  as  required  by  the  designer. 

The  scenario  reads  as  follows:  Intelligence  from  the  field  has  informed  Blue  that  the  adver¬ 
sary  (RedD)  has  organized  a  force  to  conduct  operations  in  a  distinct  part  (a  province)  of  the 
Area  of  Responsibility.  Intelligence  has  also  indicated  that  the  leadership  consists  of  six  persons 
with  the  command  structure  as  shown  in  Fig.  6.4.  The  Field  Intelligence  Officers  have  different 
areas  of  responsibility. 


Fig.  6.4  Command  Relationship  Chart  for  Red 


The  cultural  constraints  for  the  two  countries  are  also  known. 

TABLE  6.1  Cultural  Constraints 


#F 

m 

#H 

#c: 

Blue 

2 

0 

1-3 

2-3 

Red 

2-4 

0 

1-5 

2-4 
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Given  the  scenario  and  the  cultural  attributes  of  Red  and  Blue,  can  one  infer  the  possible  or¬ 
ganizational  structure  of  the  Red  Force  and  its  information  exchanges  so  that  Blue  can  focus  its 
ISR  assets  to  the  right  targets? 

Based  on  the  command  relationship  chart,  one  can  deduce  the  number  of  decision  makers 
(six  in  this  case)  and  also  specify  the  interactions  between  them; 

•  The  Field  Intelligence  Officers  interact  with  the  environment  and  send  their  Situation  As¬ 
sessment  to  the  Intelligence  Officer. 

•  The  Intelligence  Officer  fuses  this  information  and  sends  his  Assessment  to  the  Force 
Commander. 


•  Based  on  the  information  received,  the  Force  Commander  directs  the  Director  of  Opera¬ 
tions  to  develop  a  Course  of  Action 

•  The  Director  of  Operations  in  turn  directs  the  Commander  of  Operations  to  develop  a 
plan  based  on  the  COA  and  execute  it. 

•  The  variable  links  have  been  introduced  into  the  problem  based  on  the  type  of  interactions 

that  usually  exist  in  command  and  control  organizations.  They  may  or  may  not  exist  in 
the  Red  group.  Cultural  attributes  will  be  used  to  determine  probable  links. 


This  can  be  represented  in  block  diagram  form  as  shown  in  Fig.  6.5.  This  information  can  al¬ 
so  be  represented  in  matrices  form  as  shown  below  where  ‘  1  ’  represents  a  fixed  type  interaction 
and  ‘x’  represents  a  variable  type  interaction  (Fig.  6.6). 


Fig.  6.5  Block  Diagram  of  the  Organization  as  seen  in  the  CAESAR  III  GUI 

The  resulting  universal  net  is  shown  in  Fig.  6.7.  Running  the  lattice  algorithm  without  intro¬ 
ducing  the  cultural  attributes  at  this  point  helps  design  all  feasible  organizational  structures  that 
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meet  the  specific  constraints  of  the  problem.  The  resulting  solution  space  has  a  single  lattice 
bounded  by  one  MINO  and  one  MAXO.  Figure  6.8  shows  the  partially  expanded  solution  space. 

Applying  Red’s  cultural  attributes  to  the  solution  space  places  further  constraints  on  the 
number  of  allowable  interactions  and  helps  determine  the  (plausible)  organizational  structures 
that  Red  may  be  employing.  The  resulting  solution  consists  of  one  MINO  and  3  MAXOs  and  is 
shown  in  Fig.  6.9. 
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Fig.  6.6  Matrix  representation  of  the  design  problem 
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Fig.  6.8  Partially  expanded  solution  space 

The  C-MAXOs  and  the  C-MINOs  lie  within  the  MAXOs  and  the  MINOs,  i.e.,  the  culturally 
bound  solution  space  is  contained  in  the  un-constrained  solution  space. 
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Fig.  6.9  Culturally  Constrained  Solution  Space  for  Red 
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An  expanded  lattice  is  shown  in  Fig.  6.10.  All  the  structures  that  lie  between  a  C-MINO  and 
a  C-MAXO  satisfy  the  cultural  constraints.  The  actual  Petri  nets  corresponding  to  the  CMINO 
and  C-MAXOs  are  shown  in  Figs.  6.1 1  to  6.14. 


Fig.  6.10  Expanded  Lattice  Structure  from  C-MINO(l)  to  CMAXO(  1)  for  Red 
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Fig.  6.1 1  C-MINO(l)  for  Red 
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Fig.  6.12  C-MAXO(l)  for  Red 
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Fig.  6.13  C-MAXO(2)  for  Red 
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Fig.  6.14  C-MAXO(3)  for  Red 
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Applying  Blue’s  cultural  attributes  to  the  original  problem  results  in  only  one  C-MINO  and 
one  C-MAXO.  The  corresponding  expanded  lattice  is  as  shown  in  Fig.  6.15. 

The  actual  Petri  net  corresponding  to  the  C-MAXO  is  shown  in  Figure  6.16.  The  C-MINO 
for  Blue  is  the  same  as  the  C-MINO  for  Red. 

Since  the  constrained  solution  space  for  Red  has  only  one  C-MINO,  which  is  connected  to  all 
the  three  C-MAXOs,  the  C-MINO  represents  the  set  of  interactions  that  must  be  present  in  all  the 
structures  that  satisfy  the  cultural  attributes  of  Red.  Further  analysis  of  this  structure  can  help 
identify  the  high  value  ISR  targets.  In  cases  where  there  are  more  than  one  MINOs,  identifying 
the  interactions  that  are  common  to  all  the  C-MINOs  will  indicate  which  areas  to  target  for  ISR 
activities. 
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Fig.  6.15  Expanded  Lattice  Structure  from  C-MINO(l)  to  CMAXO(l)  for  Blue 
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Fig.  6.16  C-MAXO(l)  for  Blue 
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Looking  at  the  solution  spaces  for  the  two  cases,  it  is  easy  to  see  that  the  cultural  attributes  do 
play  a  role  in  the  final  structure  of  the  decision-making  organizations  and  can  provide  valuable 
insight  into  possible  structures  that  may  be  used  by  an  adversary. 


6.7  CoaUtion  Modeling  Using  CAESAR  III 

The  computational  approach  for  the  design  of  adversary  organizations  can  also  be  applied  to  coa¬ 
lition  operations.  This  is  illustrated  using  a  hypothetical  example  in  which  an  emergency  situa¬ 
tion  in  an  island  nation  requires  rapid  humanitarian  assistance  and  disaster  relief  as  well  as  secur¬ 
ing  military  assets.  The  alternative  architecture  designs  and  the  associated  simulations  to  eva¬ 
luate  performance  were  carried  out  using  CAESAR  III. 

The  scenario  depicts  a  situation  in  which  anarchy  has  risen  on  an  island  due  to  a  recent  earth¬ 
quake  that  caused  substantial  damage.  The  infrastructure  and  many  of  the  government  buildings 
are  destroyed  in  the  island’s  capital.  The  US  maintains  a  ground  station  that  receives  data  from 
space  assets.  It  is  concerned  about  the  rising  tensions,  as  there  has  been  opposition  to  its  presence 
on  the  island.  As  a  result,  US  decides  to  send  an  Expeditionary  Strike  Group  (ESG)  to  the  island 
to:  (1)  provide  timely  Humanitarian  Aid/  Disaster  Relief  (HA/DR)  to  three  sectors  of  the  island; 
and  (2)  counteract  the  effects  of  any  hostile  attacks  which  impede  the  normal  operation  of  the 
HA/DR  mission  and  the  security  of  the  ground  station.  As  the  ESG  is  away  for  the  first  critical 
day  of  the  operation,  countries  A  and  B  offer  help  to  support  the  mission  and  agree  to  take  part  in 
a  Coalition  Force  that  would  be  commanded  remotely  by  the  US  ESG  commander.  It  is  assumed 
that,  close  to  the  island,  both  countries  hold  different  elements  for  an  ESG  compatible  Coalition 
Force,  which  can  be  deployed  in  a  matter  of  hours,  while  the  ESG  rushes  to  the  island. 

A  team  of  five  decision-making  units  carries  out  the  HA/DR  mission.  The  team  is  organized 
in  the  divisional  structure  and  each  unit  under  the  team  has  its  sub-organizations  and  staff  to  per¬ 
form  the  tasks  allocated  to  it.  The  five  units  are: 

(1)  ESGC:  Commander; 

(2)  MEUC-Commander  of  the  Marine  Expeditionary  Unit; 

(3)  ACE-Air  Combat  Element  with  its  Commander  and  sub-organizations; 

(4)  GCE-Ground  Combat  Element  with  its  Commander  and  sub-organizations;  and 

(5)  CSSE-Combat  Service  Support  Element  with  its  Commander  and  sub-organizations. 

It  is  assumed  that  country  A  can  provide  support  as  ACE,  GCE  and  CSSE  while  country  B 
can  only  provide  support  as  GCE  and  CSSE.  The  roles  of  ESGC  and  MEUC  remain  with  the  US. 
The  countries  are  able  to  provide  rapid  assistance  in  coordination  with  each  other  and  the  design 
question  becomes  the  allocation  of  different  tasks  to  partners  in  this  ad-hoc  coalition. 

This  is  a  multi-level  design  problem  in  which  interactions  between  different  decision  making 
units  need  to  be  determined  both  at  the  higher  level  (Level- 1)  as  well  as  at  the  lower  level 
(Level-2).  The  top  level  interactions  correspond  to  interactions  between  culturally  homogenous 
subunits,  while  the  bottom  level  design  problem  consists  of  designing  the  internal  structure  of 
these  homogenous  subunits  based  on  a  defined  set  of  interactional  constraints  and  culture.  Based 
on  the  structure  of  the  ESG,  one  can  impose  user  constraints  to  design  the  level- 1  organization. 


112 


Figure  6.17  shows  the  block  diagram  of  this  organization  as  designed  in  CAESAR  III;  the 
matrices  describing  the  interactions  are  shown  in  Fig.  6.18. 


Fig.  6.17  Level- 1  organizational  block  diagram. 
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Fig.  6.18  Matrix  Representation  corresponding  to  Fig.  6.17 


Figure  6.19  shows  the  result  of  running  the  lattice  algorithm  on  level- 1  organization.  The  solu¬ 
tion  space  contains  one  MINO,  Fig.  6.20,  and  one  MAXO,  Fig.  6.21.  The  designer  can  pick  a 
structure  from  this  space  and  use  it  to  design  the  sub-organizations  at  level-2. 


113 


Fig.  6.19.  Solution  space  for  Level-1  organization  design  as  seen  in  CAESAR  III 
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Fig.  6.20  MINO  of  Level- 1  design 


Fig.  6.21  MAXO  of  Level- 1  design 


Level- 1  design  is  free  of  cultural  constraints.  However  Level-2  design  uses  the  C-Lattiee  al¬ 
gorithm  to  inelude  cultural  attributes  to  form  the  various  coalition  options.  The  sub-organizations 
of  ACE,  GCE  and  CSSE  are  designed  using  CAESAR  III.  Figures  6.22,  6.23  and  6.24  show  the 
respeetive  bloek  diagrams  along  with  the  matrices  speeifying  the  user  eonstraints.  Since  the  US 
always  performs  the  roles  of  ESGC  and  MEUC,  these  sub-organizations  are  not  deeomposed  fur¬ 
ther. 
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Fig.  6.22  Block  diagram  and  matrix  representation  for  ACE 
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Fig.  6.23  Block  diagram  and  matrix  representation  for  GCE 
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Fig.  6.24  Block  diagram  and  matrix  representation  for  CSSE 

Table  6.2  gives  the  Hofstede’s  scores  for  US,  Country  A  and  Country  B.  Using  a  multiple  li¬ 
near  regression  model,  these  scores  are  converted  into  limits  to  be  placed  on  allowable  interac¬ 
tions  based  on  culture.  These  are  imposed  as  additional  structural  constraints  on  the  solution 
space  of  the  sub-organizations.  The  cultural  constraints  for  the  three  sub-organizations  are  shown 
in  tables  6.3,  6.4  and  6.5.  Maximum  indicates  the  limit  placed  on  the  number  of  interactions  by 
user  constraints. 


TABLE  6.2  Hofstede’s  scores  for  the  three  countries 


Country 

PDI 

IND 

MAS 

UAI 

US 

40 

91 

62 

46 

A 

38 

80 

14 

53 

B 

66 

37 

45 

85 

TABLE  6.3  Cultural  Constraints  corresponding  to  ACE 


Country 

#F 

#G 

#H 

#C 

Maximum 

0<F<4 

0 

0<H<3 

2<C<5 

US 

3<F<4 

0 

2<H<3 

3 

A 

2 

0 

2<H<3 

3 

B 

2 

0 

1 

4<C<5 
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TABLE  6.4  Cultural  Constraints  corresponding  to  GCE 


Country 

#F 

#G 

#H 

#c 

Maximum 

0 

0<G<3 

0<H<3 

0<C<3 

US 

0 

2 

2<H<3 

2 

A 

0 

2 

2<H<3 

1 

B 

0 

2<G<3 

2 

2<C<3 

TABLE  6.5  Cultural  Constraints  corresponding  to  CSSE 


Country 

#F 

#G 

#H 

#C 

Maximum 

1<F<3 

0 

0<H<4 

3<C<5 

US 

2<F<4 

0 

3<H<4 

3 

A 

2 

0 

3<H<4 

3 

B 

2 

0 

2 

4<C<5 

Using  the  C-Lattice  algorithm,  the  solution  space  for  each  sub-organization  is  computed  for  each 
culture  and  a  suitable  structure  is  selected  by  the  user.  These  structures  are  then  used  to  form  the 
different  coalition  options  and  analyze  the  performance.  In  view  of  the  limited  space,  the  com¬ 
plete  solution  spaces  are  not  shown  here.  Figures  6.25-6.27  show  the  structures  selected  by  the 
user  for  each  country  for  CSSE.  A  similar  approach  can  be  use  to  select  different  structures  to  be 
used  for  ACE  and  GCE. 


Fig.  6.25  GCE  structure  selected  for  US 


Fig.  6.26  GCE  structure  selected  for  Country  A 
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Fig.  6.27  GCE  structure  selected  for  Country  B 


Once  the  structure  is  selected,  CAESAR  III  has  the  functionality  of  exporting  it  as  a  Colored 
Petri  net  to  CPN  Tools  where  it  can  be  simulated  to  analyze  performance.  For  the  given  scenario, 
based  on  the  availability  of  support  from  the  two  countries,  eight  coalition  options  are  possible, 
excluding  the  homogeneous  option  of  all  US.  The  five  sub-organizations  are  combined  together 
using  Level- 1  MINO  and  the  eight  options  were  simulated  to  study  performance  in  terms  of  tasks 
served.  The  following  assumptions  are  made.  Each  process  (transition)  needs  50  units  of 
processing  time.  Each  additional  incoming  link  increases  this  time  by  50  units.  The  reasoning  is 
that  the  additional  input(s)  will  require  more  processing.  Hence,  structures  that  have  more  inte¬ 
ractions  will  take  more  time  to  process  the  tasks,  which  will  affect  the  overall  performance.  Fig¬ 
ure  6.28  shows  the  results  of  this  analysis  for  all  combinations.  The  x-axis  shows  the  percentage 
of  tasks  un-served. 

Based  on  these  results,  US-US-US-B-A  performs  best.  Most  options  with  country  B  in  the 
CSSE  role  perform  badly.  This  is  because  country  B  needs  a  high  number  of  command  relation¬ 
ships  and  the  structure  of  CSSE  allows  for  this  to  occur,  thereby  increasing  the  processing  delay. 
User  constraints  on  GCE  allow  for  very  similar  cultural  constraints  for  all  countries  and  hence 
changing  the  ordering  in  this  role  does  not  change  the  performance  very  much.  Similar  results 
were  obtained  when  the  coalition  options  were  simulated  using  a  Level- 1  MAXO  organization. 


Fig.  6.28  Percent  of  tasks  un-served  for  coalition  options. 

A  previously  developed  methodology  for  the  computational  design  of  information  processing 
and  decision  making  organizations  has  been  enhanced  to  include  cultural  constraints  that  affect 
the  choice  of  organizational  structures.  While  the  Hofstede  cultural  dimensions  have  been  used, 
other  cultural  metrics  can  be  used  to  derive  the  cultural  constrains.  A  simple  example  illustrates 
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the  approach  for  designing  coalition  organizations  and  analysing  their  performance.  The  results 
indicate  that  culture  does  affect  the  structure  and  working  of  organizations  thereby  affecting  the 
overall  performance.  This  could  aid  in  the  allocation  of  different  tasks  to  partners  in  an  ad-hoc 
coalition. 

6.8  Conclusion 

A  previously  developed  methodology  for  the  computational  design  of  information  processing 
and  decision  making  organizations  has  been  enhanced  to  include  cultural  constraints  that  affect 
the  choice  of  organizational  structures.  While  the  Hofstede  cultural  dimensions  have  been  used, 
other  cultural  metrics  can  be  used  to  derive  the  cultural  constrains  R5  to  R8.  Two  examples  illu¬ 
strates  the  approach:  one  for  adversary  organizations  and  one  for  coalition  organizations.  The 
results  indicate  that  culture  does  affect  the  structure  and  working  of  organizations  thereby  affect¬ 
ing  the  overall  performance. 
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Chapter  7 


Extracting  Adversarial  Relations  from  Texts 

Kathleen  M.  Carley 


7.1  Introduction 

There  is  a  need  to  identify  texts  and  extract  from  them  various  information  about  the  adversary, 
their  interactions,  activities,  beliefs,  resources  and  so  on.  We  used  in  this  project  a  rapid  ethno¬ 
graphic  assessment  procedure  that  moved  from  data  to  model  using  a  semi-automated  text  analy¬ 
sis  process.  Key  data  used  was  newspaper  reports.  Over  the  course  of  the  project  this  procedure 
became  increasingly  automated  and  the  ability  to  identify  agents  and  their  activities  improved 
dramatically.  Central  to  this  process  is  the  AutoMap  tool.  AutoMap  is  based  on  network  text 
analysis  and  so  converts  texts  to  networks  of  relations.  We  found  it  useful  to  first  extract  the  se¬ 
mantic  network  and  then  the  meta-network  composed  of  agents,  resources,  expertise,  locations, 
activities,  beliefs  and  organizations.  We  note  that  beliefs  are  the  most  difficult  to  extract. 

Data  mining  is  commonly  used  to  identify  and  extract  entities.  Named  Entity  Recognition  is 
used  to  classify  items  such  as  people  or  locations  [142].  Machine  Learning  is  used  widely  to  aid 
in  the  classification.  Aspects  of  the  data  that  give  clues  as  to  classification  category  are  word 
length,  part-of-speech,  and  external  sources  such  as  gazetteers  and  ontologies.  Some  algorithms 
parse  at  the  shallow  level  of  words  only,  and  other  parse  deeply  with  machine  understanding  of 
part  of  speech  and  sentence  semantics.  Spatiotemporal  knowledge  discovery  techniques  are  de¬ 
scribed  by  Roddick  and  Lees  [143],  and  location  techniques  by  Buttenfield  et  al.  [144]. 

Reliance  on  a  gazetteer  may  improve  the  computer’s  ability  to  recognize  locations.  Gazet¬ 
teers  differ  in  scope,  coverage  and  balance,  accuracy,  and  entry  specificity.  Choice  of  gazetteer 
influences  match  results.  The  gazetteer  can  supply  additional  background  knowledge  that  is  help¬ 
ful  in  data  analysis.  Some  researchers  use  existing  gazetteers  such  as  the  National  Geospatial  In¬ 
telligence  Agency  gazetteer*  or  GeoNames,^  while  others  generate  them  automatically  [145]  or 
derive  them  from  Wikipedia  [146].  Semantic  technologies  have  been  used  to  identify  network 
data  in  texts  before  [147],  [148].  Workshops  such  as  the  Data  Mining  WebKDD/SNAKDD  2007 
[149]  and  conference  presentations  [150]  have  been  devoted  specifically  to  mining  data  for  so¬ 
cial  network  analysis. 


*  National  Geospatial  Intelligence  Agency  gazetteer  for  download  at 
http://earthinfo.nga.mil/gns/html/ 

^  http://www.geonames.org 
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7.1.1  Network  Text  Analysis  (NTA) 

Network  Text  Analysis  is  a  set  of  methodologies  for  converting  texts  to  graphs  based  on  the 
theory  that  language  and  knowledge  can  be  modeled  as  networks  of  words  and  relations  such 
that  meaning  is  inherent  in  the  structure  of  that  network.  NTA  encodes  links  among  words  to 
construct  a  network  of  linkages.  Specifically,  this  method  analyzes  the  existence,  frequencies, 
and  covariance  of  terms  and  themes,  thus  subsuming  classical  Content  Analysis. 

7.1.2  Semantic  Network  Analysis 

In  map  analysis,  a  concept  is  a  single  idea,  or  ideational  kernel,  represented  by  one  or  more 
words.  Concepts  are  equivalent  to  nodes  in  Social  Network  Analysis  (SNA).  The  link  between 
two  concepts  is  referred  to  as  a  statement,  which  corresponds  with  an  edge  in  SNA.  The  relation 
between  two  concepts  can  differ  in  strength,  directionality,  and  type.  The  union  of  all  statements 
per  texts  forms  a  semantic  map.  Maps  are  equivalent  to  networks 

7.2  AutoMap 

Texts,  e.g.,  newspaper  articles,  blogs,  and  the  stories  told  by  people,  are  a  key  source  of  cultural 
and  ethnographic  information.  AutoMap  [151]  is  a  text  mining  tool  that  enables  the  extraction  of 
information  from  texts  using  Network  Text  Analysis  methods.  AutoMap  supports  the  extraction 
of  several  types  of  data  from  unstructured  texts.  The  type  of  data  that  can  be  extracted  includes: 
content  analytic  data  (words  and  frequencies),  semantic  network  data  (the  network  of  concepts), 
meta-network  data  (the  cross  classification  of  concepts  into  their  ontological  category  such  as 
people,  places  and  things  and  the  connections  among  these  classified  concepts),  and  sentiment 
data  (attitudes,  beliefs).  Each  of  these  modes  assumes  the  foregoing. 

Coding  in  AutoMap  is  computer-assisted;  the  software  applies  a  set  of  coding  rules  specified 
by  the  user  in  order  to  code  the  texts  as  networks  of  concepts.  Coding  texts  as  maps  focuses  the 
user  on  investigating  meaning  among  texts  by  finding  relationships  among  words  and  themes. 
The  coding  rules  in  AutoMap  involve  text  pre-processing,  statement  formation,  and  post¬ 
processing  which  together  form  the  coding  scheme.  AutoMap  exists  as  part  of  a  text  mining  suite 
that  includes  a  series  of  pre-processors  for  cleaning  the  raw  texts  so  that  they  can  be  processed 
and  a  set  of  post-processor  that  employ  semantic  inferencing  to  improve  the  coding  and  deduce 
missing  information.  These  pre-processors  include  such  sub-tools  as  a  .pdf  to  .txt  converters, 
non-printing  character  removal,  and  limited  types  of  de-duplication.  Text  pre-processing  con¬ 
denses  data  into  concepts,  which  capture  the  features  of  the  texts  relevant  to  the  user.  Statement 
formation  rules  determine  how  to  link  concepts  into  statements.  The  postprocessors  include  such 
tools  procedures  that  link  to  gazetteers  and  augment  the  coding  with  latitude  and  longitude,  be¬ 
lief  inference  procedures,  and  data  secondary  data  cleaning  tools.  In  addition  there  are  a  series  of 
support  tools  for  creating,  maintaining,  and  editing  delete  lists  and  thesauri.  AutoMap  exports 
data  in  DyNetML  and  can  be  used  interoperably  with  *ORA. 

AutoMap  is  focused  around  the  idea  that  meaning  is  carried  in  the  way  in  which  concepts  are 
linked  [148].  Concepts  are  words  or  phrases  that  represent  a  single  ideational  kernel;  e.g.,  hope 
or  United_States_of_America  are  both  concepts.  To  identify  the  concepts,  non-content  bearing 
words  are  often  deleted  and  thesauri  are  used  to  map  alternative  spellings  and  phrasing  into  a 
single  concept.  Syntactic  clues  are  used  to  define  connections  among  concepts  leading  to  strong¬ 
er  linkages  being  built  among  concepts  within  the  same  phrase,  than  in  the  same  sentence,  than 
in  the  same  paragraph.  In  its  simplest  form,  a  semantic  network  is  built  by  building  a  network 
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where  two  concepts  are  linked  just  in  case  they  are  within  so  many  words  of  each  other  or  occur 
in  the  same  sentence.  Ontological  thesauri  that  map  concepts  into  categories  are  then  used  to 
cross-classify  concepts  into  agents,  organizations,  knowledge,  resources,  locations,  beliefs,  tasks 
and  events.  This  cross-classification  results  in  a  set  of  networks  -  i.e.,  a  meta-network  [152]. 

AutoMap  is  first  used  to  extract  entities  (the  nodes),  then  links,  then  to  cross-classify  entities 
into  ontological  categories.  Entity  extraction  involves  locating  and  classifying  terms  that 
represent  instances  of  entity  classes  of  the  meta-network  that  deviate  from  the  classical  set  of 
entities  in  text  data.  Unlike  traditional  text  mining,  which  focuses  only  on  named  entities 
(people,  places,  organizations),  we  also  extract  more  fuzzy  entities,  such  as  tasks  (e.g.  signing  a 
contract)  and  resources  (e.g.  vehicles),  which  are  not  necessarily  referred  to  by  a  name.  The  fol¬ 
lowing  excerpt  from  an  UN  News  Service  (New  York)  article  released  on  12-28-2004  illustrates 
the  EE  task: 

Jan  Pronk,  the  Special  Representative  of  Secretary-General  Kofi  Annan  to  Sudan,  today  called 
for  the  immediate  return  of  the  vehicles  to  World  Food  Pro2ramme  (WFP)  and  NGOs. 

The  underlined  concepts  are  the  entities  in  the  meta-network.  The  quality  and  accuracy  of  the 
extracted  network  depends  on  the  quality  of  the  entities  extracted.  AutoMap  uses  a  combination 
of  sub-models  to  extract  these  entities.  These  sub-models  include  utilization  of  thesauri  and  the 
use  of  Conditional  Random  Fields  for  entity  identification.  Conditional  Random  Fields  allow  for 
modeling  the  relationship  among  yi  and  yi-l  as  a  Markov  Random  Field  (MRF)  that  is  condi¬ 
tioned  on  X.  MRF  are  a  general  framework  for  representing  undirected,  graphical  models.  In 
CRT,  the  conditional  distribution  of  an  entity  sequence  y  given  an  observation  sequence  (string 
of  text  data)  x  is  computed  as  the  normalized  product  of  potential  functions  Mi  [153],  [154]. 

The  resulting  entity  extraction  process  using  Conditional  Random  Fields  consists  of  two 
steps.  First,  the  Conditional  Random  Field  is  used  to  locate  the  terms  that  are  relevant  entities. 
These  terms  are  then  marked  as  being  a  part  of  a  relevant  entity.  Second,  the  Conditional  Ran¬ 
dom  Field  is  used  to  classify  the  identified  relevant  entities.  In  order  to  do  this,  consecutive 
words  that  have  been  identified  as  belonging  to  entities  are  merged  into  one  concept.  This  con¬ 
cept  is  represented  as  a  concatenation  of  the  consecutive  entity  words. 

When  using  AutoMap  to  identify  adversarial  networks,  the  following  features  were  particu¬ 
larly  useful:  anaphora  resolution,  deletion  of  stop  words,  thesaurus  generalization,  and  meta¬ 
network  thesauri  (ontological  cross-classification).  In  general,  a  windowing  technique  was  used 
for  placing  links  and  links  were  placed  among  entities  occurring  within  a  window  defined  as  two 
contiguous  sentences.  Finally,  gazetteers  were  used  to  add  latitude  and  longitude  for  locations 
terms. 

7.2.1  Anaphora  resolution 

Anaphora  resolution  identifies  the  social  entities  that  pronouns  refer  to.  Co-reference  resolution 
identifies  multiple  instances  of  unique  real-world  entities  that  multiple  text  phrases  reference. 
The  application  of  these  preprocessing  steps  in  the  process  of  extracting  relational  data  from  un¬ 
structured  text  data  can  impact  the  entity  frequency  count,  identity  of  entities  and  of  the  identifi¬ 
cation  of  relations  between  entities.  It  is  not  uncommon  for  these  steps  to  modify  15  percent  of 
the  edges. 
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7.2.2  Deletion  of  stop  words 

Stop  words  are  those  words  whose  presence  has  little  content  of  value  to  the  analysis.  Often, 
words  such  as  a,  an,  the,  to,  for  will  fall  in  this  category.  Lists  of  common  stop  words  exist  in  the 
machine  learning  community.  We  used  these  and  augmented  them  with  a  set  of  commonly  un¬ 
used  concepts  in  assessing  adversarial  relations.  We  have  found  it  efficacious  to  remove  most 
articles,  prepositions,  numbers,  terms  referring  to  temporal  indicators  such  as  days  of  the  week, 
and  terms  referring  to  intensity  such  as  more  or  fewer. 

These  stop  words  are  collected  into  a  delete  list.  These  concepts  are  then  removed  before  ad¬ 
ditional  work  on  thesaurus  construction  is  done.  In  general,  you  should  create  a  cut-off  limit  (e.g. 
a  word  needs  to  be  used  at  least  three  times.  Concepts  used  less  than  that  would  be  placed  in  the 
Delete  List. 

7.2.3  Thesauri  generalization 

One  of  the  key  issues  in  assessing  texts  is  that  different  words  are  used  to  describe  the  same 
thing.  For  people,  we  might  think  of  these  alternatives  as  aliases.  Thesauri  are  generally  used  to 
take  multiple  concepts,  in  different  forms,  and  compile  them  under  one  key  concept.  The  purpose 
of  a  generalization  thesaurus  is  to  cluster  together  all  those  concepts  that  refer  to  the  same  entity 
effectively  forming  a  set  of  coding  rules  for  translating  those  concepts  into  the  general  term.  This 
generalization  process  can  be  used  for  aliases,  to  remove  alternative  ending,  decrease  the  impacts 
of  plurals,  and  combine  concepts  where  differences  in  nuance  are  not  relevant  to  the  analysis. 

Standard  stemmers,  which  reduce  words  to  their  base  such  as  farming  and  farmed  to  farm 
tend  to  over  generalize  and  do  not  retain  part-of-speech  distinction.  This  we  prefer  to  use  special¬ 
ly  design  stemmers  that  preserve  part-of-speech  thus  enabling  auto-identification  of 
tasks/activities  and  generic  actors.  These  specialized  stemmers  are  part  of  the  automatically  con¬ 
structed  generalization  thesauri. 

For  adversarial  reasoning,  the  key  effort  in  thesaurus  construction  needs  to  go  into  the  con¬ 
struction  of  alias  files  for  organizations  and  people.  These  tend  to  be  specific  to  adversarial  group 
when  referring  to  names  entities  and  so  specific  people  and  groups.  In  contrast,  other  thesauri 
referring  to  activities  or  “generic”  people,  e.g.,  farmers,  can  be  used  across  studies. 

7.2.4  Meta-network  thesauri 

The  meta-network  is  an  ontological  categorization  of  nodes  in  this  case  concepts  into  the  who, 
what,  when,  where,  how  why  needed  to  assess  groups  [152].  The  meta-network  is  a  multi-mode, 
multiplex  model  that  reifies  these  entity  classes  as:  agent,  knowledge,  resource,  task,  event,  or¬ 
ganization,  location,  belief,  time. 

Instance  of  an  entity  class  can  have  attributes,  e.g.  the  attribute  of  agent  John  might  be  age, 
42  and  gender,  male.  The  relations  among  the  elements  within  and  across  any  entity  classes  form 
certain  types  of  networks.  For  example,  a  social  network  is  composed  of  relations  among  agents, 
and  a  membership  network  consists  of  connections  among  agents  and  organizations.  The  meta¬ 
network  model  allows  for  analyzing  socio-cultural  systems  as  a  whole  or  in  terms  of  one  or  more 
of  the  networks  contained  in  the  model.  This  ontological  schema  has  been  used  to  empirically 
assess  power,  vulnerability,  and  organizational  change  in  a  diversity  of  contexts  such  as  situa¬ 
tional  awareness  in  distributed  work  teams,  email  communication  in  business  corporations  and 
counterterrorism  [155],  [156],  [157]. 
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7.5  Data  to  Model  Processing 

Each  text  is  processed  to  remove  noise  and  clean  the  text,  to  combine  multi-word  concepts  into  a 
single  concept,  to  normalize  the  concepts  into  a  reduced  vocabulary,  and  to  categorize  concepts 
into  the  meta-network  ontology  [152],  The  meta-network  ontology  includes  agents,  organiza¬ 
tions,  locations,  events,  knowledge,  resources,  and  tasks  (i.e.  activities). 

Initial  cleaning  of  the  texts  involves  reformatting  as  well  as  a  generic  cleaning.  The  generic 
activities  include  preprocessing  used  to  correct  the  text.  Examples  include  typo  correction,  the 
expansion  of  contractions  and  abbreviations.  Pronoun  resolution  should  be  done  and  unidentified 
pronouns  removed.  Identification  of  compound  concepts  is  done  by  applying  a  list  of  concept¬ 
changing  n-grams.  While  typically  the  use  of  an  n-gram  is  to  identify  words  that  are  most  com¬ 
monly  used  together,  in  this  context  an  n-gram  is  a  multi-word  concept  whose  definition  changes 
when  the  concepts  are  reviewed  individually  versus  as  a  single  compound  entity.  Examples  of 
concept-changing  n-grams  are  "first  aid"  and  "black  market". 

Concepts  are  segmented  into  specific  and  general  types.  The  specific  concepts  identify  in¬ 
stances  of  items,  such  as  George  W.  Bush  for  agent,  UNICEF  for  organization,  and  Pittsburgh 
for  location.  General  concepts  include  soldier  (agent),  tank  (resource),  and  base  (location).  Many 
of  the  general  concepts  in  the  ontology  can  be  pre-established.  Some  minor  adaptation  needs  to 
be  done  based  on  the  domain  as  "front"  is  different  for  a  military  domain  as  opposed  to  "front" 
when  speaking  about  weather  forecasting.  Some  specific  entities  can  be  pre-established  from  ex¬ 
isting  lists  such  as  a  list  of  all  countries  or  major  cities,  or  a  list  of  world  leaders. 

The  processing  material  requires  project-based  modifications  beyond  what  can  be  pre- 
established.  Project-based  specific  entities  can  be  found  by  reviewing  all  proper  nouns  identified 
in  the  corpus  by  applying  part-of-speech  analysis.  For  convenience,  proper  nouns  adjacent  to  one 
another  can  be  listed  in  an  n-gram  form  as  many  project-based  specifics  are  compound  concepts. 
Alternatively,  the  approach  to  finding  specific  compound  concepts  would  involve  the  generation 
of  all  n-gram  possibilities,  which  is  prohibitively  large  for  human  review  beyond  bigrams  (n- 
grams  with  N=2).  The  list  of  possible  concepts  of  interest  can  be  culled  by  removing  all  concepts 
already  placed  in  an  ontological  category.  Using  the  pre-established  material  significantly  reduc¬ 
es  the  amount  of  human  involvement. 

A  base  thesaurus  is  formed  from  the  pre-existing  ontologically  categorized  concepts  and 
augmented  with  project-based  material.  The  current  pre-existing  generics  material  consists  of 
22,455  entries.  The  current  pre-existing  base  material  (including  general  and  specific  entities) 
consist  of  150,749  entries.  A  number  of  scenarios  were  examined  including  the  following: 

1.  A  scenario  driven  deterrence  assessment:  Uses  a  corpus  of  27,000  text  files  from  news 
sources  and  government  websites.  The  project-based  thesaurus  added  only  an  additional  962 
entries.  The  resulting  meta-networks  contained  7,605  entities. 

2.  A  military  multi-actor  experiment.  Uses  a  corpus  of  3,100  text  files  from  news  sources,  web 
sites,  and  communication  logs.  The  project-based  thesaurus  added  only  an  addition  500  en¬ 
tries. 

3.  Open-source  information  on  the  Sudan.  Uses  a  corpus  of  71,000  text  files  from  news  sources, 
web  sites,  books,  as  well  as  additional  information  from  a  wide  variety  of  collected  informa¬ 
tion  by  scholar  experts.  The  project-based  thesaurus  includes  38,552  location  listings  ex¬ 
tracted  from  a  gazetteer  leaving  16,001  unique  entries. 
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The  use  of  pre-existing  thesauri  reduced  significantly  the  amount  of  work  needed  to  extract  a 
meaningful  meta-network.  The  cleaning  of  the  text,  extraction  of  proper  nouns  and  the  subse¬ 
quent  removal  of  pre-existing  items  for  human  review,  and  the  generation  of  the  meta-network 
using  pre-existing  and  project-based  thesauri,  are  all  examples  of  workflows.  The  workflows  are 
a  sequence  of  common  steps  used  to  perform  a  task,  often  using  different  inputs  or  different  the¬ 
sauri.  These  web  services  can  be  composed  into  domain-specific  workflows  that  can  be  used  by 
analysts  to  automate  and  manage  common  sequences  of  operations.  The  workflows  automate  the 
task  management  allowing  the  analyst  to  focus  on  the  domain  and  not  on  keeping  track  of  the 
individual  steps  to  be  taken.  By  sharing  workflows,  a  consistent  approach  for  data-to-model  is 
established.  When  advances  are  made,  the  workflow  can  be  easily  adapted  to  the  new  capability 
and  the  data-to-model  processing  re-run. 

7.6  Limitations  and  Next  Steps 

The  global  learning  of  features  along  with  their  corresponding  weights  comes  at  a  price:  Training 
the  identifier  and  classifier  while  using  a  reasonable  iteration  rate  for  the  gradient  takes  a  very 
long  time.  This  limitation  can  be  addressed  to  some  degree  by  using  more  powerful  hardware, 
especially  by  using  more  memory.  Furthermore,  an  ability  to  add,  change,  or  remove  labels  from 
the  used  ontology  is  essential  to  having  a  flexible  yet  robust  learning  and  research  process.  While 
the  meta-network  has  many  labels  of  interest,  it  is  likely  that  the  model  may  be  altered  as  it 
evolves  in  the  future. 

Conditional  Random  Fields  enable  us  to  detect  relevant  entities  along  with  their  correspond¬ 
ing  weights  without  having  to  have  any  preliminary  or  initial  guess  about  what  some  of  those 
features  might  be  for  a  particular  data  set  or  domain.  This  means  we  can  let  the  computer  do  all 
the  work  as  long  as  we  provide  it  with  some  labeled  training  data.  However,  such  uninformed 
global  learning  approach  comes  at  a  price:  Additionally,  other  techniques  for  improved  entity 
extraction  should  be  considered.  These  include  things  such  as  improved  anaphor  resolution,  enti¬ 
ty  inference  for  beliefs  and  events,  and  attribute  extraction  for  concepts  such  as  automated  cross 
classification  of  resources  and  activities  by  DIME/PMESII  areas. 

However  key  improvements  will  require  improved  link  identification.  Extracting  network 
ties,  or  relations  between  entities,  is  substantially  harder  than  entity  recognition.  State-of-the-art 
systems  perform  less  well  on  this  task  than  on  the  recognition  task.  Most  research  on  relation  ex¬ 
traction  assumes  that  the  entities  have  been  identified  correctly.  Main  methods  for  extracting  re¬ 
lations  between  entities  are  to  discover  verb  relations  [158],  construct  concept  graphs  based  on 
rules  [159],  or  use  proximity  to  find  relations  within  a  sentence  using  a  “word  window”  [160]. 
These  techniques  however  need  to  be  augmented  with  syntactic  hierarchical  parsing;  i.e.,  placing 
links  within  clause,  then  sentence,  then  paragraph.  In  additional,  machine  learning  techniques 
may  also  be  used  for  improved  link  identification. 
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Chapter  8 


Inferring  and  Assessing  Informal  Organizational  Structures 
from  an  Observed  Dynamic  Network  of  an  Organization 

Il-Chul  Moon,  Kathleen  M.  Carley,  Alexander  H.  Levis 


8.1  Introduction 

In  today’s  world  there  are  many  organizations  or  groups  that  are  organized  virtually  or  covertly. 
Open  source  project  teams,  teams  in  massive  multi-player  on-line  games,  and  terrorist  organiza¬ 
tions  are  just  a  few  examples.  For  these  organizations,  what  is  known  is  what  can  be  observed. 
What  can  be  observed  are  the  networks  connecting  individuals,  resources,  and  activities  across 
many  lines  and  types  of  communications?  Clearly  there  are  many  types  of  relations  in  this  ob¬ 
served  structure  not  all  of  which  are  necessarily  work  related.  For  these  organizations,  the  orga¬ 
nizational  chart,  the  workflow,  the  formal  structure  is  likely  not  to  be  known  a  priori.  Indeed,  it  is 
unlikely  that  there  is  a  formal  structure  in  the  sense  of  a  declaration  by  the  organization  about 
who  reports  to  whom  and  is  doing  what.  Nevertheless,  it  is  likely  that  the  operational  structure  of 
the  organization,  who  shares  information  with  whom,  resolves  issues,  etc.  is  embedded  in  the 
observed  structure.  If  we  could  infer  this  operational  structure  from  the  observed  structure  we 
would  have  an  improved  understanding  of  how  work  is  done  in  these  groups,  their  strengths,  and 
their  vulnerabilities. 

We  propose  and  approach  for  inferring  the  operational  structure  from  the  observed  structure. 
The  observed  and  the  operational  structure  are  likely  to  have  distinct  profdes,  e.g.,  key  personnel 
and  clusters  of  individuals.  This  is  because  the  operational  is  focused  only  on  work  related  activi¬ 
ties  whereas  the  observed  is  a  concatenation  of  all  activities,  a  snapshot  of  human  endeavors.  We 
illustrate  the  efficacy  of  this  approach  using  data  collected  on  a  real-world,  terrorist  organization. 
The  proposed  approach  expands  the  horizon  of  organizational  analysis  by  enabling  researchers  to 
identify  and  assess  these  operational  structures. 

Understanding  an  organization’s  structure  is  critical  when  we  attempt  to  understand,  inter¬ 
vene  in,  or  manage  the  organization  [161].  However,  organizational  structures  in  the  real  world 
often  differ  from  their  recognized  formal  structure  [162],  and  sometimes  its  membership  con¬ 
ceals  the  formal  structure  with  various  types  of  social  interactions  and  communications  [163]. 
Furthermore,  when  we  observe  the  actual  social  interactions  among  the  members  of  the  group, 
the  observed  social-network  data  are  often  noisy,  and  contain  misleading  and  uncertain  links 
[164].  The  following  two  scenarios  exemplify  the  impending  confusion  about  the  identification 
of  an  organizational  structure. 

Scenario  1:  TF  is  an  employee  of  a  global  investment  bank  in  Hong  Kong.  In  the  formal  organi¬ 
zational  chart,  he  reports  administratively  to  the  bank’s  financial  division  director,  who  is  also 
the  head  of  the  Hong  Kong  branch.  However,  because  of  his  assignment  to  work  on  a  global 
project,  TF  also  reports  to  two  senior  project  managers  who  manage  the  project  from  their  offic¬ 
es  in  New  York  and  London.  His  corporate  email  activity  includes  not  only  personal-activity  re- 
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porting  emails  to  the  local  administrative  manager  and  project  status  reporting  to  the  two 
project  managers,  but  also  includes  information  sharing  emails  to  work  colleagues. 

Scenario  2: 1C  is  a  developer  in  a  software  development  team  which  is  informally  organized.  He 
has  frequent  email  contact  with  the  users  and  other  team  members,  including  one  team  leader 
with  whom  he  often  reports  his  progress.  Because  there  is  no  formal  team  structure,  there  is  no 
membership  boundary  in  the  team,  so  the  team  involvement  is  determined  by  consensus  from  the 
active  members  who  are  reporting  bugs  and  developing  programs. 

In  these  scenarios,  we  identify  three  different  types  of  organizations  that  vary  in  their  boun¬ 
daries  and  explicitness.  Firstly,  the  organizational  chart  unequivocally  outlines  the  formal  hierar¬ 
chical  structure,  but  the  employees  have  another  hierarchical  reporting  structure  that  is  not  shown 
in  the  formal  chart.  Secondly,  his  email  account  shows  his  contacts,  regardless  of  the  contacts’ 
importance  or  the  nature  of  the  relations,  so  the  uncovered  email  transaction  structure  from  his 
account  contains  people  with  critical  work  relationships  and  ones  with  insignificant  relationships 
at  the  same  time.  This  second  organizational  structure  is  a  social  network  in  this  paper.  The  third 
structure,  our  definition  of  decision  making  organizational  structure  in  this  paper,  is  a  social 
structure  including  only  relevant  personnel,  or  three  formal  or  informal  bosses,  and  work  rela¬ 
tionships,  or  reports  to  the  bosses  in  terms  of  completing  the  organization’s  goal.  These  different 
organizational  structures  can  be  also  seen  in  diverse  organizations,  i.e.  grass-roots  organizations, 
self-organizing  clubs,  startup  companies,  terrorist  networks,  military  command  and  control  struc¬ 
tures,  etc.  This  paper  uses  a  terrorist  network  as  a  test  dataset. 

We  focus  on  the  differences  in  analysis  approaches  regarding  the  two  above  organizational 
structures:  meta-network  (an  extended  version  of  social  network)  and  decision  making  structure. 
Meta-network  is  a  network  representation  of  a  complex  organizational  structure.  Its  dataset  is 
gathered  from  email  transactions,  survey  from  group  members,  observations  on  social  interac¬ 
tions,  and  etc.  Meta-network  analysts  concentrate  on  finding  key  personnel,  i.e.  which  boss  is 
more  important  in  Scenario  1.  Or,  they  find  clusters,  i.e.  clusters  of  developers  of  open-source 
development  team  in  Scenario  2.  Decision  making  structure  is  an  organization  structure  design 
whose  members,  or  decision  makers,  interacts  with  each  other  in  various  purposes  over  the 
course  of  decision  making.  The  structure  is  from  organizational  charts,  survey,  or  subject-matter 
experts  of  the  organization.  Decision  making  structure  analysis  uncovers  the  information  and  re¬ 
sponse  transmissions  in  members’  cognitive  processes  while  a  decision  is  made,  i.e.  when  TF’s 
report  weigh  in  the  formal  or  informal  bosses’  decision  making  processes  in  Scenario  1,  to  what 
extent  IC  and  his  discussion  partner  share  the  information  and  when  in  Scenario  2. 

Considering  the  above  two  perspectives,  we  need  the  third  approach  that  combines  the  two. 
We  can  combine  the  approaches  in  many  ways,  i.e.  regarding  a  critical  organizational  structure 
as  a  decision  making  structure  and  applying  social  network  analysis  to  the  structure  (applying 
social  network  analysis  to  a  decision  making  structure).  Or,  we  can  see  the  meta-network  as  a 
decision  making  structure  and  estimate  the  cognitive  processes  of  members  of  the  network  (ap¬ 
plying  decision  making  structure  analysis  to  a  dynamic  network).  In  this  paper,  we  introduce  one 
approach  combination.  First,  we  extract  the  decision  making  organizational  structure  from  an 
observed  meta-network  of  a  target  organization.  For  instance,  we  extract  the  only  relevant  people 
in  the  decision  making  processes  among  TF’s  contacts  in  Scenario  1.  This  extraction  is  done  by 
considering  the  work  relationships  among  the  members  of  the  group  and  the  work  flow  of  the 
organizational  objective.  Next,  we  analyze  the  extracted  decision  making  structure  with  the  so¬ 
cial  network  analysis  approach.  For  example,  among  the  three  bosses  and  TF  in  Scenario  1,  we 
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identify  the  most  important  personnel  in  terms  of  information  delivery,  situation  cognition,  link¬ 
ing  to  others,  by  utilizing  social  network  metrics.  Then,  we  can  see  the  different  key  personnel 
lists  and  clustered  members  between  the  original  meta-network  and  the  extracted  decision  mak¬ 
ing  structure.  These  differences  imply  that  the  analysis  result  can  be  richer  if  we  investigate  not 
only  the  existing  meta-network,  but  also  the  inferred  structures  from  it. 

The  workers  segregate  and  create  clusters  socially  based  on  the  work  flow  rather  than  their 
formal  structure.  If  this  is  true,  an  analyst  may  find  out  how  well  the  formal  structure  supports 
the  current  work  practices  by  comparing  the  formal  and  informal  structures.  As  another  example, 
Rabasa  et  al.  [165]  think  that  Al-Qaeda  operatives  may  be  embedded  in  a  social  network  of  a 
community  including  civilians  and  operatives  at  the  same  time.  Although  they  co-exist  in  the  so¬ 
cial  network,  it  is  certain  that  management  activities  occur  among  the  operatives.  The  decision 
making  structure  extraction  will  reduce  or  limit  the  relevant  personnel  in  the  social  network,  will 
help  set  the  scope  of  investigations,  and  produce  various  analysis  results  from  different  decision 
making  structure  viewpoints.  Finally,  this  work  is  an  effort  linking  two  different  disciplines,  so¬ 
cial  network  analysis,  and  decision  making  structure  analysis.  Meta-networks  have  been  gathered 
from  various  terrorist  networks  and  military  organizations,  but  these  have  not  been  used  fre¬ 
quently  in  the  decision  making  structure  analysis  domain  because  the  interpretations  of  the  meta¬ 
network  and  decision  making  structure  are  different.  With  the  proposed  framework,  we  success¬ 
fully  extract  a  decision  making  structure  from  a  meta-network,  so  that  we  can  use  the  existing 
meta-network  datasets  in  further  decision  making  structure  analyses. 

8.2  Background 

Our  framework  is  presented  in  two  steps:  (a)  inferring  a  decision  making  structure  from  a  meta¬ 
network,  and  (b)  analyzing  the  extracted  structure  with  social  network  analysis  metrics  and  algo¬ 
rithms.  Thus,  the  theories  behind  our  approach  are  twofold.  First,  we  explain  the  complex  nature 
of  a  meta-network  and  how  we  exploit  the  complex  organizational  structure  in  inferring  its  deci¬ 
sion  making  structure.  Second,  we  describe  the  used  social  network  analysis  metrics  and  algo¬ 
rithms. 

8.2.1  Inferring  a  decision  making  structure  from  a  complex  system  of  an  organization 

The  organizations  of  interest  in  this  paper  exhibit  the  characteristics  of  a  complex  system.  Ac¬ 
cording  to  Morel  and  Ramanujam  [166],  there  are  two  commonly  observed  characteristics  of  a 
complex  system:  a  large  number  of  interacting  elements  and  emergent  properties.  First,  a  corpo¬ 
rate  organizational  structure  consists  of  a  large  number  of  interacting  elements  such  as  workers, 
information,  expertise,  and  resources  [167].  These  elements  should  be  assigned  and  distributed 
properly  to  perform  tasks,  and  such  assignments  and  distribution  relationships  are  the  organiza¬ 
tional  structure  of  the  corporation.  Similarly,  a  terrorist  network  is  a  collection  of  heterogeneous 
entities  interacting  with  and  assigned  to  each  other.  Though  a  traditionally  terrorist  network  was 
regarded  as  a  simple  terrorist-to- terrorist  network  [168],  [169],  recent  observations  and  analyses 
[170],  [171]  assert  that  the  terrorist  network  includes  bomb  materials,  reconnaissance  on  targets, 
as  well  as  terrorists. 

Second,  the  organizations  of  interest  have  emergent  properties.  A  synthetic  organization 
[172]  is  an  organization  established  after  a  major  event,  such  as  a  disaster.  The  organization 
emerges  around  formally  designated  offices  by  linking  NGOs  and  relevant  groups  to  the  offices. 
The  organization  self-organizes  the  work  relationships  and  seeks  a  better  structure  over  the 
course  of  the  event.  This  emerging  structure  concept  can  also  be  applied  to  corporate  and  terror- 
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ist  network  domains.  Employees  of  a  corporation  have  their  superiors  and  take  orders  from  them, 
as  in  a  hierarchical  organization,  but  they  also  keep  and  follow  work  relationships  in  practice. 
Also,  it  is  often  seen  that  a  task-force  team  emerges  before  or  after  important  events  [173].  This 
task-force  team  shows  the  emergent  properties  of  the  organizational  structure  in  a  corporation. 
Additionally,  terrorist  networks  frequently  show  the  emergent  properties  by  adapting  their  struc¬ 
tures  to  situations  [174],  [175]. 

If  the  organizations  in  focus  are  complex,  we  should  find  a  decision  making  structure  by  con¬ 
sidering  the  various  types  of  interacting  elements  and  the  adaptive  nature  of  the  structure.  At  the 
same  time,  since  the  traditional  organizational  structure  is  defined  as  a  structure  managing  indi¬ 
viduals  in  an  organization,  the  found  structure  should  contain  people-to-people  relationships. 
Thus,  we  focus  on  developing  a  model  that  takes  the  complex  nature  into  consideration  and  ge¬ 
nerates  a  set  of  work  relationships  among  the  individuals. 

CAESAR  III  [176],  [96]  is  a  model  that  we  regarded  as  a  base  of  our  developed  model.  Orig¬ 
inally,  it  was  used  to  analyze  the  cognition  processes  of  multiple  decision  makers.  The  individual 
cognitive  processes  are  structured  as  a  network  of  various  types  of  links  that  differ  in  terms  of 
inputs  and  outputs  of  the  cognitions.  Thus,  the  model  is  similar  to  our  approach.  Therefore,  our 
major  effort  in  this  paper  is  inferring  the  links  of  cognitive  processes  among  individuals  from  a 
meta-network. 

8.2.2  Assessing  vulnerabilities  and  criticalities  of  the  organizational  structure 

There  have  been  a  number  of  approaches  in  evaluating  the  organizational  structures.  For  in¬ 
stance,  traditional  management  science  developed  qualitative  evaluation  criteria  [177].  However, 
though  these  qualitative  examinations  are  insightful,  the  qualitative  approaches  have  problems. 
They  are  not  scalable  to  large  and  complex  organizations,  nor  applicable  to  various  disciplines, 
and  nor  designed  to  assess  the  complex  representation  of  a  meta-network.  Therefore,  in  this  pa¬ 
per,  we  will  use  a  quantitative  model. 

Social  network  analysis  has  been  one  of  the  most  useful  tools  in  analyzing  organizational 
structures,  i.e.  corporate  structures  and  terrorist  networks  [168],  [178]  It  is  able  to  find  key  per¬ 
sonnel  [186]  and  embedded  clusters.  Also,  it  assesses  the  characteristics,  such  as  degree  of  cen¬ 
tralization  and  levels  of  hierarchy,  of  the  organizations.  Gabbay  and  Leenders  [179]  link  the  so¬ 
cial  network  analysis  to  the  management  of  social  capital  of  a  corporation.  Also,  Reagans  and 
Zuckerman  [180]  investigate  the  performances  of  various  corporate  R&D  teams  with  social  net¬ 
work  analysis.  This  analysis  is  used  not  only  in  the  corporate  domains,  but  also  in  the  counterter¬ 
rorism  field,  and  Krebs  [168]  visualized  the  terrorist  network  responsible  for  the  9/1 1  attacks  and 
calculated  the  social  network  centrality  metrics  of  terrorists. 

In  this  work,  we  follow  the  basic  approach  of  social  network  analysis,  which  involves  calcu¬ 
lating  the  social  network  metrics  and  finding  key  entities  in  the  structure.  However,  we  are  dif¬ 
ferent  from  the  traditional  social  network  analysis  in  two  ways.  One  way  is  that  we  analyze  both 
the  original  meta-network  and  inferred  decision  making  structure.  The  other  way  is  that  we  use  a 
couple  of  metrics,  cognitive  demand  and  communication  [181]  -  which  are  not  common  in  social 
networks,  but  insightful  in  examining  a  complex  organization.  Furthermore,  we  use  QAP  and 
MRQAP  analysis  techniques.  These  techniques  have  been  used  to  correlate  two  networks  and 
regress  one  network  against  another.  We  correlate  the  inferred  structures  to  the  original  structure 
to  examine  to  what  extent  the  extracted  ones  are  embedded  in  the  original  ones. 


130 


8.3  Dataset 


Throughout  this  paper,  we  use  a  dataset  collected  from  the  1998  U.S.  Embassy  bombing  incident 
in  Kenya.  As  the  organizations  of  interests  exhibit  complex  organizations,  we  use  a  meta¬ 
network  format  [187]  to  represent  and  analyze  the  target  organization.  Meta-network  is  an  ex¬ 
tended  version  of  a  social  network,  including  various  types  of  nodes  and  heterogeneous  links, 
which  follow  the  nature  of  a  complex  system.  Initially,  this  dataset  is  from  a  network  text  analy¬ 
sis  [182]  on  open-source  documents,  but  later,  the  soundness  and  realism  of  the  dataset  were  ve¬ 
rified  by  human  analysts.  This  meta-network  dataset  is  appropriate  for  this  analysis  for  a  couple 
of  reasons.  First,  it  has  a  directed  terrorist-to-terrorist  network  required  for  inferring  a  Command 
Interpretation  structure,  which  will  be  explained  later,  included  in  the  expected  decision  making 
structure.  Second,  it  has  a  detailed  task  network.  With  inputs  from  human  analysts,  the  dataset 
has  a  detailed  task  procedure  of  the  incident,  so  it  is  particularly  appropriate  when  we  extract  a 
decision  making  structure  for  the  completion  of  a  certain  task. 

As  our  framework  starts  with  a  meta-network,  the  initial  input  dataset  is  a  collection  of  ter¬ 
rorists,  information  and  resources  for  the  bombing  and  related  tasks.  Fig  8.1  is  the  visualization 
of  the  meta-network  of  the  Kenya  case.  Also,  we  visualized  two  sub-networks,  the  terrorist  social 
network  in  Fig.  8.2  and  the  task  precedence  network  in  Fig.  8.3.  The  basic  statistics  of  this  net¬ 
work  is  listed  in  Table  8.1  and  Table  8.2.  For  each  of  the  sub-networks,  there  is  an  interpretation 
for  the  links.  For  instance,  the  link  in  a  social  network  represents  that  the  two  terrorists  interacted 
or  communicated  with  each  other,  and  the  link  in  a  task  assignment  network  shows  that  the  ter¬ 
rorist  was  assigned  to  completion  of  the  linked  task. 


TABLE  8.1  The  meta-network  of  the  dataset,  a  terrorist  group  responsible  for  1998  U.S.  embas¬ 
sy  bombing  in  Kenya.  The  numbers  in  the  cells  are  the  densities  of  the  adjacency  matrices. 


Terrorist 

Expertise 

Resource 

Task 

Terrorist 
(17  terrorists) 

Social  Network 
(0.147) 

Information 

Distribution 

Network 

(0.095) 

Resource  Dis¬ 
tribution  Net¬ 
work  (0.088) 

Task  Assign¬ 
ment  Network 
(0.126) 

Expertise 
(8  bits) 

Not  used 

Not  used 

Required  Ex¬ 
pertise  Network 
(0.048) 

Resource 
(8  resources) 

Not  used 

Required  Re¬ 
source  Network 
(0.076) 

Task 
(13  tasks) 

Task  Prece¬ 
dence  Network 
(0.121) 
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Fig.  8.1  The  visualization  of  the  meta-matrix  of  the  terrorist  group  responsible  for  the  1988  U.S. 

embassy  bombing  in  Kenya 


kenya-imoon 


Fig.  8.2  The  terrorist  social  network  in  the  meta-matrix 
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Fig.  8.3  The  task  network  in  the  meta-matrix 


TABLE  8.2  A  table  of  descriptive  statistics  for  the  metrics.  This  table  includes  means,  standard 

deviations,  and  a  cross-correlation  table. 


Mean 

Std. 

Dev. 

Total 

Degree 

Cen¬ 

trality 

Between¬ 
ness  Cen¬ 
trality 

Eigenvec¬ 
tor  Cen¬ 
trality 

Cogni¬ 

tive 

Demand 

Communica¬ 

tion 

Total  Degree 
Centrality 

0.092 

1 

0.047 

8 

1.0000 

0.7411 

0.4880 

0.9113 

0.4030 

Betweenness 

Centrality 

0.006 

5 

0.007 

3 

0.7411 

1.0000 

-0.0650 

0.8384 

0.2870 

Eigenvector 

Centrality 

0.033 

7 

0.020 

4 

0.4880 

-0.0650 

1.0000 

0.3087 

0.3802 

Cognitive 

Demand 

0.068 

1 

0.039 

3 

0.9113 

0.8384 

0.3087 

1.0000 

0.3929 

Communica¬ 

tion 

0.696 

4 

0.189 

7 

0.4030 

0.2870 

0.3802 

0.3929 

1.0000 

8.4  Method 

Our  framework  is  about  extracting  a  decision  making  structure  from  the  meta-network  of  an  or¬ 
ganization  as  well  as  analyzing  and  comparing  the  extracted  structure  and  the  original  meta¬ 
network.  In  this  section,  we  introduce  how  to  infer  a  potential  decision  making  structure  in  the 
first  stage  and  network  metrics  in  the  second  stage. 
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While  the  analysis  procedures  are  largely  in  two  steps,  there  are  five  detailed  stages  in  this  analy¬ 
sis  framework.  The  extraction  requires  three  stages.  First,  we  obtain  a  target  organization  to  ana¬ 
lyze  and  its  task  of  interest.  Second,  we  identify  the  sub-task  network  by  including  only  relevant 
tasks  to  the  completion  of  the  task  of  interest,  and  this  leads  to  limiting  the  personnel  involved. 
Third,  the  target  organization  is  examined  from  three  perspectives:  information  sharing,  result 
sharing,  and  command  interpretation.  Each  of  the  examinations  generates  a  decision  making 
structure  corresponding  to  the  perspective. 

The  analysis  and  comparison  are  done  in  two  steps.  First,  we  compare  the  extracted  structure  to 
the  original  network.  Additionally,  we  estimate  to  what  extent  we  can  recreate  the  original  struc¬ 
ture  with  the  extracted  ones.  These  comparisons  show  the  effectiveness  and  the  usefulness  of  the 
extraction  overall,  since  we  expect  the  extracted  structure  to  be  based  on  the  meta-network,  but 
not  be  exactly  the  same  structure.  Second,  we  evaluate  the  network  metrics  of  individuals,  identi¬ 
fy  the  key  personnel,  and  see  the  differences  between  the  key  personnel  list  from  the  original  and 
the  extracted  structures. 

This  framework  is  also  designed  to  convert  the  meta-network  into  an  input  dataset  for  CAESAR 
III  model,  a  decision  making  structure  analysis  framework.  While  we  discuss  and  experiment 
inferring  a  structure  for  CAESAR  III  from  a  meta-network,  we  do  not  utilize  CAESAR  III  to 
analyze  the  extracted  model  from  its  viewpoint.  Our  evaluation  analysis  is  limited  to  social  net¬ 
work  approaches. 


Fig.  8.4  The  procedure  of  the  introduced  analysis  framework 
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8.4.1  Extracting  a  decision  making  structure  from  a  meta-network 

The  scope  of  the  decision  making  structure  is  limited  by  focusing  on  a  single  task  execution. 
This  way  restricts  the  number  of  individuals  who  make  up  the  extracted  structure  and  makes  the 
others  as  the  outside  collaborators.  As  the  number  of  individuals  of  interests  decreases,  we  can 
focus  on  the  investigation  of  the  specific  task  performance  and  keep  the  generated  structure  re¬ 
cognizable  to  human  analysts.  Also,  in  the  management  science  community,  these  selected  indi¬ 
viduals  are  regarded  as  decision  makers,  so  this  limitation  differentiates  between  a  social  agent 
and  a  decision  maker  in  the  structure. 

After  selecting  the  decision  makers,  we  infer  the  various  management  relations  by  utilizing  the 
social  network  as  well  as  the  task  assignment,  the  information,  and  the  resource  distribution  net¬ 
works.  For  instance,  when  two  members  are  connected  with  a  communication  path  and  one  has 
expertise  required  for  the  other,  the  shortest  path  may  be  the  information  sharing  path  in  terms  of 
management  relationships.  With  similar  methods,  in  addition  to  the  information  sharing  relation¬ 
ships,  we  infer  result  sharing  and  command  interpretation  relationships.  These  are  originated 
from  three  different  structural  links  in  the  CAESAR  III  model.  In  the  model,  information  shar¬ 
ing,  result  sharing,  and  command  interpretation  links  are  different  in  their  timings  of  message 
arrival.  Information  sharing  messages  are  delivered  after  the  sender  is  aware  of  the  situation  and 
before  the  receiver  performs  the  information  fusion.  Result  sharing  is  done  after  the  sender’s  re¬ 
sponse  selection.  Command  interpretation  occurs  before  the  receiver’s  response  selection.  The 
information  fusion,  response  selection,  and  command  interpretation  are  the  cognitive  processes 
defined  in  CAESAR  III. 

Limiting  task  network  and  finding  decision  makers 

Since  the  decision  making  structure  in  this  paper  is  task-oriented,  our  framework  aims  to  extract 
a  structure  responsible  for  completing  a  certain  final  task.  This  task  is  a  user-defined  parameter. 
With  the  given  final  task,  we  can  retrace  a  sub-task  network  from  a  meta-network  by  following 
the  prerequisite  tasks  repeatedly,  starting  from  the  final  task.  For  example,  in  Fig  8.4,  the  final 
task  is  overall  planning  and  execution',  then,  its  sub-prerequisite  tasks  are  surveillance  of  possi¬ 
ble  targets,  final  reconnaissance  mission  and  arrange  for  facilitation  and  delivery.  These  four 
tasks  consist  of  the  sub-task  network  for  extraction,  and  the  12  terrorists  assigned  to  those  tasks 
are  the  decision  makers  of  this  task-oriented  decision  making  structure. 

After  limiting  the  involved  decision  makers,  we  aggregate  the  uninvolved  agents  as  an  out¬ 
side  organization.  It  is  typical  to  see  a  decision  making  structure  interacting  with  outside  organi¬ 
zations.  If  we  configure  a  task-based  sub-decision  making  structure,  some  of  the  individuals  will 
be  excluded,  since  they  are  not  doing  the  tasks  in  the  sub-task  network.  However,  it  is  still  possi¬ 
ble  that  the  excluded  ones  hold  required  resources  or  information,  and  this  will  require  commu¬ 
nications  between  the  selected  decision  makers  of  the  extracted  structure  and  the  outside  organi¬ 
zation,  which  is  the  group  of  the  excluded  individuals.  Thus,  finding  assigned  decision  makers 
doesn’t  just  limit  the  personnel  of  the  decision  making  structure,  but  also  specifies  the  boundary 
decision  makers  interacting  with  outside  entities.  In  this  example,  we  have  a  total  17  terrorists, 
and  12  terrorists  are  selected  as  decision  makers.  Thus,  the  other  5  terrorists  form  the  outside  or¬ 
ganization  of  this  decision  making  structure. 
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Fig.  8.5  The  partial  visualization  of  the  task  precedence  network  (task-to-task)  and  the  task  as¬ 
signment  network  (terrorist-to-task).  The  dashed  line  represents  the  separation  of  the  task  net¬ 
work  and  the  assigned  agents.  When  users  set  up  overall  planning  and  execution  as  a  final  task 
for  the  extraction,  the  visualized  tasks  and  the  individuals  are  the  components  of  the  sub-task 
network,  and  the  accompanying  decision  makers,  respectively. 


Information  sharing  structure 

In  a  meta-network,  a  piece  of  information,  or  expertise,  is  represented  as  a  knowledge  node. 
Thus,  we  assume  that  producing  information  is  represented  as  a  link  from  an  agent  node  to  a 
knowledge  node.  Also,  we  infer  that  one  decision  maker  will  acquire  information  through  an  in¬ 
formation  sharing  path  if  1)  he  needs  the  information  to  perform  his  assigned  tasks,  2)  he  does 
not  have  the  information,  and  3)  the  information  sharing  path  is  the  shortest  path  from  the  nearest 
decision  maker  holding  the  information  for  him.  Figure  8.5  describes  the  case  of  information 
sharing  links.  According  to  the  sub-network  in  the  figure,  Ali  Mohamed  is  assigned  to  surveil¬ 
lance  of  possible  targets,  which  requires  surveillance  expertise.  However,  surveillance  expertise 
is  not  available  to  Ali  Mohammed,  but  available  to  Anas  Al-Liby.  Then,  Ali  Mohamed  finds 
shortest  paths  possible  to  Anas  Al-Liby,  and  he  finds  the  shortest  paths  with  two  social  links 
going  through  Osama  bin  Laden,  Hamza  Al-Liby  or  Muhammad  Atef.  Then,  the  links  in  these 
three  shortest  paths  will  be  the  information  sharing  links. 

Result  sharing  structure 

Result  Sharing  (RS)  is  communication  from  a  decision  maker  finishing  his  assigned  task  to  a  de¬ 
cision  maker  with  a  task  that  required  the  previously  done  task.  For  instance,  there  is  a  RS  com¬ 
munication  from  a  terrorist  who  finished  surveillance  of  possible  targets  to  a  terrorist  who  will 
perform  overall  planning  and  execution.  Figure  8.6  shows  the  above  two  tasks  and  their  assigned 
agents.  Surveillance  of  possible  targets  has  three  assigned  agents,  and  overall  planning  and  ex¬ 
ecution  has  eight  agents.  Then,  there  will  be  21  result  sharing  links  originating  from  the  three 
agents  to  the  seven  agents,  excluding  the  agent  who  is  assigned  to  the  next  task  and  already 
knows  the  results  of  the  previous  task. 
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Fig.  8.6a  A  partial  visualization  explaining  the  formation  of  information  sharing  links:  First  step, 
Ali  Mohamed  is  assigned  to  surveillance  of  possible  targets. 
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Fig.  8.6b  Second  step,  Ali  Mohamed  requires  surveillance  expertise  to  perform  his  assigned  task, 

but  he  does  not  have  it. 
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Fig.  8.6c  Third  step,  the  organization  searches  an  agent  with  surveillance  expertise  from  the 
agents  near  to  Ali  Mohamed.  It  finds  an  agent  two  social  links  away,  Anas  Al-Liby. 
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Fig.  8.6d  Fourth  step,  Anas  Al-Liby  has  the  required  expertise  and  has  to  deliver  the  expertise 

through  the  soeial  links. 
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Fig.  8.6e  Fifth  step,  there  are  three  possible  shortest  paths  from  Anas  Al-Liby  to  Ali  Mohamed. 

These  paths  are  information  sharing  links. 

8.4.2  Assessing  a  network  structure  with  measures 

The  original  meta-network  and  the  inferred  decision  making  structures  are  all  in  the  meta-matrix 
format.  Therefore,  we  apply  network  analysis  metrics  to  assess  the  criticality  of  individuals  in  a 
network.  The  metrics  are  five:  Degree  centrality,  Betweenness  centrality,  Eigenvector  centrality. 
Cognitive  demand,  and  Communication.  The  detailed  interpretation  is  in  Table  8.3. 
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Fig.  8.7  A  partial  visualization  of  two  tasks  and  ten  assigned  agents.  This  precedence  task  rela¬ 
tion  will  result  in  21  result  sharing  links  between  the  agents  doing  the  prior  task  and  the  agents 
performing  the  next  task.  One  agent  who  is  doing  both  does  not  need  any  result  sharing  link. 


TABLE  8.3  Three  traditional  centrality  metrics  and  two  dynamic  network  metrics  used  to  as¬ 
sess  the  criticalities  of  individuals  in  the  structure 


Name 

Interpretation 

Reference 

Degree  Centrality 

Number  of  in-coming  and  out-going  links  from  a 
node,  Degree  of  direct  influence  to  others 

Freeman 

[184] 

Betweenness  Cen¬ 
trality 

Number  of  shortest  paths  passing  a  node,  Degree 
of  information  flow  control 

Freeman 

[184] 

Eigenvector  Cen¬ 
trality 

Calculates  the  eigenvector  of  the  largest  positive 
eigenvalue  of  the  adjacency  matrix.  Degree  of 
connections  to  the  high-scoring  nodes 

Bonacich 

[185] 

Cognitive  De¬ 
mand 

Measures  the  total  amount  of  effort  expended  by 
each  agent  to  do  his/her  tasks,  calculation  details 
are  elaborated  below. 

Carley  [181] 

Communication 

Measures  the  communication  need  of  agents  to 
complete  their  assigned  tasks,  calculation  details 
are  elaborated  below. 

Carley  [181] 
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8.5.  Results 


The  described  decision  making  structure  extraction  scheme  is  applied  to  the  U.S.  embassy  bomb¬ 
ing  in  Kenya  case,  and  the  task  of  interest  was  detonation.  Next,  we  regress  the  decision  making 
structures  against  the  original  meta-network  structure  to  find  which  decision  making  structure  is 
embedded  in  the  observed  network  and  to  what  extent.  After  estimating  the  overall  correlation 
level  between  the  original  and  the  extracted  structures,  we  describe  and  visualize  the  extracted 
structure.  Next,  we  calculate  five  network  metrics  on  the  original  meta-network  and  three  differ¬ 
ent  management  networks.  Comparisons  on  the  calculated  metrics  provide  an  insight  into  who 
stands  out  in  different  settings  and  why.  Also,  we  identify  the  clusters  based  on  the  factor  analy¬ 
sis  of  the  metrics  of  the  four  networks. 

8.5.1  Initial  result  and  descriptive  statistics 

Figure  8.7  is  the  visualization  of  the  extracted  decision  making  structures  for  the  detonation  task, 
and  the  image  is  generated  by  ORA  [185].  The  collection  of  these  extracted  networks  is  an  input 
dataset  for  the  CAESAR  III  model,  and  subsequent  cognitive  process  analysis  in  decision  mak¬ 
ing  structure  can  be  done  with  the  model.  However,  we  leave  the  analysis  as  our  future  work  in 
this  paper.  Whereas  the  original  meta-network  has  17  members,  the  extracted  structure  has  only 
14.  The  removed  members  are  not  related  to  the  task  network  of  detonation.  The  topologies  of 
the  structures  are  different.  First,  the  information  sharing  structure  is  somewhat  similar  to  the 
person-to-person  network  of  the  meta-network.  The  inference  of  the  information  sharing  is  done 
by  trimming  the  links  not  included  in  the  information  passage.  Therefore,  the  base  of  the  infor¬ 
mation  sharing  is  the  person-to-person  network  (social  network),  so  the  inferred  network  resem¬ 
bles  the  social  network.  Second,  the  result  sharing  network  is  very  different  from  the  social  net¬ 
work.  The  result  sharing  is  inferred  from  the  task  dependency  network  and  task  assignment  net¬ 
work.  Due  to  the  difference  between  the  result  sharing  structure  and  the  social  network,  this  or¬ 
ganization  may  suffer  from  the  delivery  of  information  about  the  completion  of  prerequisites 
during  the  task  execution  period.  Finally,  the  command  interpretation  structure  only  includes 
three  individuals.  In  the  original  social  network,  most  of  the  individuals  are  linked  as  a  circle 
with  directed  links.  Therefore,  the  inference  on  the  command  interpretation  is  not  clear  for  most 
of  the  members.  However,  Osama  bin  Laden,  Wadih  el-Hage  and  Abdel  Rahman  show  a  clear 
hierarchy  in  the  social  network.  We  do  not  believe  that  the  actual  command  interpretation  is  as 
sparse  as  the  inferred  structure,  but  from  the  observed  structure,  there  is  no  clear  way  to  infer  the 
hierarchy  of  the  other  members. 

8.5.2  Embedded  decision  making  structures  in  an  observed  meta-network 

We  analyze  how  the  extracted  decision  making  structure  was  embedded  in  the  observed  meta¬ 
network  and  to  what  extent.  We  use  the  QAP/MRQAP  technique  to  compare  and  to  regress  the 
extracted  decision  making  structures  to  the  original  network.  This  is  a  statistical  analysis  to  sup¬ 
port  the  qualitative  findings  of  Section  5.1.  If  the  meta-network  implies  such  decision  making 
structures,  the  correlation  and  the  R-square  of  the  regression  result  will  be  high.  Table  4  displays 
the  result  of  QAP  correlations  between  each  of  the  extracted  structures  and  the  meta-network. 
Information  sharing  is  very  highly  correlated  with  the  original  structure.  This  high  correlation  is 
from  the  heuristic  of  the  extraction.  When  we  extract  the  information  sharing  links,  we  just  trim 
the  existing  links,  not  add  ones.  However,  the  high  correlation  also  tells  us  that  there  were  not 
many  trimmed  links,  which  implies  that  the  observed  social  links  served  well  as  information  dif¬ 
fusion  paths.  The  low  correlation  between  the  result  sharing  structure  and  the  meta-network  is 
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coming  from  many  additions  of  links.  This  means  that  the  network  does  not  adequately  support 
informing  the  result  of  the  prerequisite  tasks  to  the  individuals  doing  subsequent  tasks. 


Fig.  8.8  Three  extracted  decision  making  structures.  (Top)  Information  sharing,  (Middle)  Result 

sharing,  (Bottom)  Command  interpretation 
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TABLE  8.4  A  table  of  QAP  correlation  and  other  distance  metrics  between  the  original  struc¬ 
ture  and  the  extracted  decision  making  structures.  (IS=Information  Sharing,  RS=Result  Sharing, 

CI=Command  Interpretation) 


Cl 

IS 

RS 

Correlation 

0.2204 

0.8181 

0.1399 

Significance 

0.0200 

0.0000 

0.0510 

Hamming  Dis¬ 
tance 

34.0000 

12.0000 

81.0000 

Euclidean  Dis¬ 
tance 

5.8310 

3.4641 

9.0000 

The  MRQAP  analysis  in  Table  8.5,  between  the  extracted  structures  as  independent  variables 
and  the  meta-network  as  a  dependent  variable,  results  in  a  high  R-squared  value,  0.6759.  This  is 
a  very  high  value  considering  the  R-squared  is  usually  very  low  in  MRQAP  analyses.  As  the 
previous  correlation  indicates,  the  information  sharing  structure  was  the  biggest  contributor  in 
estimating  the  link  existence  in  the  meta-  network.  The  levels  of  standard  coefficients  of  the 
command  interpretation  and  the  result  sharing  structures  are  similar.  However,  the  result  sharing 
structure  was  more  significant  than  the  command  interpretation  while  the  information  sharing 
was  far  more  significant  than  the  other  two.  From  this  MRQAP  result,  we  can  see  that  the  origi¬ 
nal  meta-network  can  be  explained  by  the  decision  making  structures  and  it  embeds  those  struc¬ 
tures.  However,  the  result  sharing  and  the  command  interpretation  are  not  as  well  represented  as 
the  information  sharing. 

TABLE  8.5  A  table  of  MRQAP  regression  results.  The  dependent  network  is  the  observed 
meta-network,  and  the  independent  networks  are  the  extracted  meta-network.  (R-Squared  = 

0.6759) 


Variable 

Coef 

Std.Coef 

Sig.Y- 

Perm 

Sig.Dekker 

Constant 

0.0288 

0.0000 

Cl 

0.2080 

0.0524 

0.2250 

0.0400 

IS 

0.7876 

0.8232 

0.0000 

0.0000 

RS 

-0.0487 

-0.0648 

0.1790 

0.0600 

8.5.3  Personnel  with  different  levels  of  importance  in  structures 

Table  8.6  shows  the  top  three  individuals  in  the  four  structures  (original  meta-network,  informa¬ 
tion  sharing,  result  sharing,  and  command  interpretation)  and  by  using  five  metrics  (degree  cen¬ 
trality,  betweenness  centrality,  eigenvector  centrality,  cognitive  demand,  and  communication). 
When  observing  the  importance  of  individuals  in  the  extracted  structures,  Osama  bin  Laden 
stands  out  in  the  information  sharing  aspect.  In  the  original  observed  network,  he  ranked  seventh 
in  degree  centrality,  ninth  in  cognitive  demand,  and  has  zero  betweenness  centrality,  though  he 
ranked  second  in  eigenvector  centrality.  However,  the  information  sharing  network  ranks  him 
second  in  betweenness  centrality.  Also,  Wadih  el-Hage  is  an  individual  with  high  importance  in 
the  extracted  structures.  He  is  not  ranked  in  the  top  three  with  any  metrics  of  the  original  net¬ 
work.  However,  he  is  ranked  second  (RS)  and  third  (Cl)  in  degree  centrality;  first  (IS  and  Cl)  in 
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betweenness  centrality;  and  third  (Cl)  in  eigenvector  centrality,  etc.  Actually,  Wadih  el-Hage, 
whose  alias  is  the  Manager,  was  actively  engaged  in  and  even  managed  this  terrorist  attack. 
While  the  human  analyst  and  the  network  text  analyzer  generated  a  meta-network  not  reflecting 
his  importance,  our  inference  and  the  meta-network  including  expertise,  resources,  and  tasks  are 
able  to  find  his  importance  in  the  organizational  structure.  These  over-  or  under-estimations  on 
the  criticality  of  personnel  can  be  found  from  the  metrics  of  other  individuals,  i.e.  Anas  al-Liby. 


TABLE  8.6:  A  table  of  top  three  individuals  from  five  metrics  and  four  structures  (ORI=original 
meta-network,  IS=Information  Sharing,  RS=Result  Sharing,  CI=Command  Interpretation) 


Measure 

Structure 

Rank  I 

Rank  2 

Rank  3 

ORI 

Mohammed  Rashed 

Ali  Mohamed 

Fazul  Abdullah 

Daoud  al-Owhali 

Mohammed 

IS 

Mohammed  Rashed 

Ali  Mohamed 

Fazul  Abdullah 

Total  Degree 

Daoud  al-Owhali 

Mohammed 

Centrality 

RS 

Anas  Al-Liby 

Wadih  el-Hage 

Abdullah  Ahmed 
Abdullah 

Cl 

Ali  Mohamed 

Mohammed  Rashed 
Daoud  al-Owhali 

Wadih  el-Hage 

ORI 

Mohammed  Rashed 

Fazul  Abdullah 

Abdel  Rahman 

Daoud  al-Owhali 

Mohammed 

Betweenness 

Centrality 

IS 

Wadih  el-Hage 

Osama  Bin  Laden 

Fazul  Abdullah 
Mohammed 

RS 

Jihad  Mohammed 

Fazul  Abdullah 

Ali  Mohamed 

Ali 

Mohammed 

Cl 

Wadih  el-Hage 

Abdel  Rahman 

Osama  Bin  Laden 

ORI 

Anas  Al-Liby 

Osama  Bin  Laden 

Ali  Mohamed 

Eigenvector 

Centrality 

IS 

Anas  Al-Liby 

Osama  Bin  Laden 

Ali  Mohamed 

RS 

Anas  Al-Liby 

Abdullah  Ahmed 
Abdullah 

Osama  Bin  Laden 

Cl 

Anas  Al-Liby 

Ali  Mohamed 

Wadih  el-Hage 

ORI 

Mohammed  Rashed 
Daoud  al-Owhali 

Ali  Mohamed 

Abdel  Rahman 

Cognitive  De¬ 

IS 

Mohammed  Rashed 
Daoud  al-Owhali 

Ali  Mohamed 

Abdel  Rahman 

mand 

RS 

Abdel  Rahman 

Mohammed  Rashed 
Daoud  al-Owhali 

Anas  Al-Liby 

Cl 

Mohammed  Rashed 
Daoud  al-Owhali 

Ali  Mohamed 

Abdel  Rahman 

ORI 

Abdel  Rahman 

Mohammed  Rashed 
Daoud  al-Owhali 

Jihad  Mohammed 

Ali 

Communica¬ 

IS 

Jihad  Mohammed 

Ali 

Muhammed  Atef 

Wadih  el-Hage 

tion 

RS 

Jihad  Mohammed 

Ali 

Muhammed  Atef 

Wadih  el-Hage 

Cl 

Jihad  Mohammed 

Ali 

Muhammed  Atef 

Wadih  el-Hage 
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Figure  8.9  shows  that  the  difference  of  metric  evaluation  results  across  the  original  meta-network 
and  decision  making  structures.  Specifically,  we  subtract  a  metric  value  of  a  meta-network  from 
the  value  of  an  decision  making  structure.  Overall,  the  differences  of  the  metrics  are  big,  which 
indicates  the  inference  estimated  the  levels  of  individuals’  importance  quite  differently.  Howev¬ 
er,  the  difference  in  betweenness  centralities  from  the  original  network  and  decision  making 
structures  are  quite  similar  except  for  a  few  individuals. 

Osama  bin  Laden  (AO)  and  Wadih  el-Hage  (A2)  show  extreme  underestimations  in  between¬ 
ness  centrality  of  the  original  network  compared  to  that  of  the  information  sharing  network. 
When  we  remember  that  betweenness  centrality  is  specialized  in  the  information  diffusion  pas¬ 
sage  and  the  information  sharing  network  is  an  inferred  information  flow  network  from  a  meta¬ 
network,  those  two  are  the  key  personnel  in  diffusing  information  pieces  in  this  network.  Also, 
Abu  Ubaidah  Al-banshiri  (All)  is  somewhat  underestimated  in  the  result  sharing  structure.  He 
has  a  big  positive  difference  in  degree  centralities,  eigenvector  centralities,  and  cognitive  de¬ 
mand,  which  means  that  he  has  higher  value  in  result  sharing  compared  to  the  original  observa¬ 
tion. 


TABLE  8.7  I.D.  assignments  to  individuals.  I.D.s  will  be  used  to  distinguish  individuals  in  the 
later  tables.  We  used  some  abbreviations  for  names  (Fazul=  Fazul  Abdullah  Mohammed,  Jihad= 
Jihad  Mohammed  Ali,  Banshiri=  Abu  Ubaidah  al-Banshiri) 


Name 

Osama 
Bin  La¬ 
den 

Muham 

med 

Atef 

Wadih 

el-Hage 

Ayman 

Al- 

Zawahiri 

Anas  Al- 
Liby 

Abdel 

Rahman 

Fazul 

Al- 

Owhali 

ID 

AO 

A1 

A2 

A3 

A4 

A5 

A6 

A7 

Name 

Ali  Mo- 
hamed 

Hamza 

Al- 

Liby 

Khalid 

Al- 

Fawwaz 

Banshiri 

Abdullah 

Ahmed 

Abdullah 

Jihad 

ID 

A8 

A9 

AlO 

All 

A12 

A13 

8.5.4  Personnel  clusters  with  similar  characteristics 

Since  we  have  four  structures  and  five  metrics  for  each  structure,  we  cannot  visualize  or  cluster 
the  individuals  without  dimensionality  reduction.  Therefore,  we  use  principal  component  analy¬ 
sis  (PCA)  to  project  the  individuals  in  two  dimensions  with  highest  variances.  Table  8.8  shows 
the  coefficients  to  generate  the  two  components  corresponding  to  the  two  dimensions,  and  Fig. 
8.10  is  the  projection  of  the  individuals  on  a  two  dimensional  scatter  plot.  The  clusters  in  the 
plots  are  member  profiles  according  to  the  criticality.  For  instance,  there  may  be  a  group  of 
people  with  high  betweenness  and  low  degree  centrality,  and  PCA  will  put  those  individuals 
close  to  each  other.  We  apply  this  analysis  to  the  two  structure  sets:  the  original  network  and  the 
collection  of  the  three  inferred  structures.  Thus,  we  can  distinguish  the  different  member  profiles 
coming  from  the  original  dataset  and  the  inferred  dataset.  Before  the  interpretation,  it  should  be 
noted  that  we  disregarded  Khalid  al-Fawwaz  (A  10)  because  he  is  an  extreme  outlier  in  PCA.  In 
the  original  and  the  inferred  networks,  he  was  the  only  one  who  had  all  the  necessary  resources 
to  execute  his  assigned  task.  This  makes  him  unique  in  the  membership  profile  and  disrupts  the 
overall  visualization  of  PCA.  Therefore,  we  perform  the  PCA  without  him,  but  he,  himself, 
forms  a  cluster  whose  profile  is  "Completely  supported  to  perform  his  task  in  terms  of  provided 
resource  and  expertise'. 
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Fig.  8.9  Charts  displaying  the  difference  of  metrics  between  a  meta-network  and  extracted  struc¬ 
tures 
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According  to  Table  8.8,  we  have  four  sets  of  coefficients:  two  principal  components  for  the  orig¬ 
inal  and  the  inferred.  In  the  original,  the  high  first  principal  component  value  implies  having 
more  connections  to  other  personnel,  resources,  and  tasks  because  it  has  high  coefficients  in  de¬ 
gree  centrality  and  cognitive  demand.  The  high  second  principal  component  value  means  high 
demand  in  communication  to  complete  the  assigned  tasks  because  it  has  high  coefficient  in 
communication.  In  the  inferred  structures,  the  meaning  of  the  first  principal  component,  low  de¬ 
mand  in  communication  to  complete  the  assigned  tasks,  is  similar  to  the  opposite  of  the  second 
principal  component  of  the  original,  and  that  of  the  second  component,  having  more  connections 
to  other  elements,  is  similar  to  the  first  component  in  the  original. 


TABLE  8.8  Coefficients  of  two  principal  components  from  the  original  structure  (top)  and  the 

extracted  structures  (bottom) 


Structure 

Prin.  Comp.  1 

Prin.  Comp.  2 

Total  Degree  Centrality 

ORI 

0.6473 

-0.4217 

Betweenness  Centrality 

ORI 

0.0920 

-0.0309 

Eigenvector  Centrality 

ORI 

0.0513 

-0.1513 

Cognitive  Demand 

ORI 

0.6088 

-0.1763 

Communication 

ORI 

0.4463 

0.8759 

Structure 

Prin.  Comp.  1 

Prin.  Comp.  2 

IS 

0.1672 

0.5702 

Total  Degree  Centrality 

RS 

-0.0848 

0.3977 

Cl 

0.0571 

0.2502 

IS 

0.0214 

0.2144 

Betweenness  Centrality 

RS 

0.0424 

0.0664 

Cl 

-0.0018 

0.0067 

IS 

0.0103 

0.1234 

Eigenvector  Centrality 

RS 

-0.0286 

0.0297 

Cl 

-0.0241 

0.0805 

IS 

0.1114 

0.4353 

Cognitive  Demand 

RS 

0.0282 

0.2082 

Cl 

0.0783 

0.3402 

IS 

-0.4370 

0.1346 

Communication 

RS 

-0.6114 

0.0850 

Cl 

-0.6114 

0.0850 

Figure  8.10  displays  the  clusters  of  individuals  in  the  projection  of  the  two  principal  components 
of  the  two  structures.  The  original  structure  suggests  five  member  profiles:  many  connections  to 
organizational  elements  and  medium  communication  demand  to  complete  their  tasks  (A6,  A8, 
A9);  medium  connections  and  medium  communication  demand  (AO,  A2,  Al,  A4,  A12);  less 
connections  and  medium  communication  demand  (A5,  A13);  less  connections  and  high  commu¬ 
nication  demand  (A3,  Al  1);  and  medium  connections  and  low  communication  demand  (A7).  The 
inferred  structures  provide  four  profiles:  medium  or  less  connections  and  low  communication 
demand  (AO,  Al,  A2,  A4,  A5,  A7,  A8,  AlO,  A12,  A13);  medium  connections  and  medium  com¬ 
munication  demand  (A9);  high  connections  and  medium  communication  demand  (A6);  and  less 
connections  and  high  communication  demand  (A3,  All).  These  profiles  tell  the  groups  of  indi- 
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viduals  well  supported  in  communication  to  complete  their  tasks  and  the  groups,  which  are  not. 
Also,  it  specifies  the  groups  communicating  frequently  with  other  parts  of  the  organizations  and 
groups  not  communicating  that  frequently.  Al  Zawahiri  and  Banshiri  were  grouped  in  the  same 
cluster  in  both  structures.  They  were  suffering  from  sparse  communications  to  others  and  high 
communication  needs  to  complete  their  tasks. 
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Fig.  8.10  Two  projections  of  metrics  of  individuals  using  two  principal  components.  The  left  is 
using  only  the  original  structure,  and  the  right  is  from  only  the  extracted  structures. 

8.6.  Conclusion 

This  paper  demonstrates  what  can  be  achieved  by  integrating  social  network  analysis  and  deci¬ 
sion  making  structure  analysis.  Social  network  analysis  has  been  a  prominent  tool  in  investigat¬ 
ing  the  structure  of  an  organization.  However,  it  is  also  susceptible  to  errors  embedded  in  the 
given  network  structure.  Therefore,  reorganizing  the  links  is  required  to  perform  analysis  correct¬ 
ly.  This  reorganization  is  often  done  by  human  analysts.  We  expect  to  reduce  such  efforts  by  uti¬ 
lizing  the  introduced  methods. 

Furthermore,  the  method  produces  a  set  of  different  decision  making  structures  that  differ 
from  each  other  in  their  natures.  For  instance,  information  sharing  is  a  different  relation  com¬ 
pared  to  result  sharing  or  command  interpretation.  When  we  only  used  a  social  network  analysis, 
often  the  links  are  single-mode,  meaning  that  the  links  are  not  differentiable.  Therefore,  the 
above  method  will  enable  analysts  to  think  about  the  different  types  of  links  among  the  same  ent¬ 
ity  types,  and  the  analysts  can  reason  more  deeply  by  asking  questions  such  as  why  these  two 
agents  have  a  command  interpretation  without  any  result  sharing. 

From  the  organizational  structure  perspective,  a  decision  making  structure  and  a  meta¬ 
network  are  both  network  structures.  Therefore,  the  analysis  methods  are  interchangeable  to 
some  extent.  For  instance,  we  can  apply  social  network  metrics  to  both  structures.  This  interope¬ 
rability  or  interchangeability  makes  the  analysis  more  comprehensive.  For  instance,  we  have  dif¬ 
ferent  sets  of  critical  personnel  by  analyzing  various  management  relations  and  an  original  meta- 
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network.  We  are  not  certain  which  set  contains  the  true  personnel  of  interests,  but  we  can  suggest 
a  package  of  results  to  human  analysts. 

Future  work  on  this  integration  will  include  two  major  components.  First,  we  should  streng¬ 
then  the  decision  making  structure  extraction  heuristics.  Currently,  the  information  sharing  ex¬ 
traction  generates  a  dense  network  that  is  not  common  in  the  management  science  field.  Also,  we 
have  a  too  sparse  command  interpretation  that  we  believe  are  more  in  the  organization.  There¬ 
fore,  we  develop  the  existing  method  further  or  validate  the  current  model  by  showing  that  the 
dense  information  sharing  and  the  sparse  command  interpretation  are  legitimate.  Second,  we 
need  to  include  more  decision  making  structure  oriented  analysis  methods  in  the  framework.  The 
result  in  this  paper  only  comes  from  social  network  analysis,  though  it  used  the  decision  making 
structure  for  the  analysis  input.  There  are  several  decision  making  structure  analysis  methods, 
e.g.  generating  a  set  of  feasible  decision  making  structures  under  certain  cultural  constraints.  In 
spite  of  these  incomplete  developments,  this  framework  still  shows  its  value  by  showing  1)  the 
trimming  process  of  a  noisy  meta-network,  2)  different  criticality  analysis  results  from  the  ex¬ 
tracted  decision  making  structure,  and  3)  the  opening  of  a  unified  organization  analysis  frame¬ 
work  integrating  social  network  analysis  and  decision  making  structure  analysis. 
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Chapter  9 


Simulating  the  Adversary:  Agent-Based  Dynamic-Network  Modeling 

Kathleen  M.  Carley,  Geoff  Morgan,  Jesse  St.  Charles,  Brian  Hirshman 


9.1  Social  Network  Simulation 

Social  network  simulation  (SNS)  is  an  emergent  area  of  research  that  combines  social  network 
analysis  and  simulation,  typically  agent-based  simulation.  This  area  is  often  referred  to  as  dy¬ 
namic  network  analysis  as  much  of  the  focus  of  the  combined  modeling  approach  is  on  how  net¬ 
works  evolve,  change,  and  adapt.  Additionally  SNS  has  a  focus  on  how  individual  and  group 
learning  and  behavior  is  impacted  by  and  impacts  the  changes  in  the  networks  in  which  the  indi¬ 
viduals  are  embedded.  Frequently,  in  social  network  simulations,  the  social  network  and  other 
networks,  such  as  the  knowledge  network,  and/or  the  individuals  or  “nodes”  in  the  network  are 
co-evolving  as  agents  interact,  learn,  and  engage  in  various  activities.  The  need  to  address  com¬ 
plex  systems  but  produce  realistic  results  means  that  these  SNS  are  typically  focusing  on  many 
types  of  networks  simultaneously  not  just  the  social  networks.  An  example  of  such  a  model 
might  be  one  that  explores  how  communicating  new  ideas  via  diverse  social-media  has  differen¬ 
tial  impact  on  the  movements  of  ideas  and  diseases  through  the  population  and  response  to  the 
information  and  disease  by  the  populace. 

There  are  various  types  of  social  network  simulation  each  has  a  unique  perspective  on  the 
problem  and  each  has  its  own  collection  of  strengths  and  weaknesses.  We  begin  with  more  for¬ 
mal  approaches  that  rely  heavily  on  statistics  and  mathematical  formalisms  and  then  move  on  to 
less  formal  bottom  up  approaches.  System  Dynamics  is  a  top  down,  aggregate  view  of  networks. 
Regression  or  econometric  approaches  like  Quadratic  Assignment  Procedure  provide  a  non- 
parametric  approach  to  modeling  dynamic  social  networks.  More  traditional  parametric  statistic¬ 
al  approaches  to  SNS  will  use  methods  such  as  Expectation  Maximization  or  Maximum- 
likelihood  estimation  to  find  the  optimal  (or  near  optimal)  model  parameters  given  the  data.  Fi¬ 
nally,  agent  based  SNS  provides  an  intuitive  bottom  up  approach  for  investigating  social  sys¬ 
tems.  Regardless  of  the  method  used  for  social  network  simulation,  there  are  unique  sets  of  chal¬ 
lenges  around  validation,  analysis,  prediction,  and  computational  efficiency  that  are  common  to 
all. 

9.1.1  System  Dynamics 

System  Dynamics  supports  top  down  reasoning  about  complex  systems.  Basic  variables,  system 
level  mechanisms  and  the  relations  between  them  are  modeled.  System  dynamics  uses  stocks, 
flows,  and  feedback  loops  to  describe  system  behavior  but  because  of  its  top-down,  aggregate 
perspective  it  is  less  useful  at  the  individual  level.  If  we  were  studying  information  diffusion  in  a 
social  network  setting,  a  system  dynamics  approach  might  have  a  stock  of  people  who  have  the 
knowledge,  and  stock  of  people  who  don’t  have  the  knowledge,  with  knowledge  flowing  be¬ 
tween  them  at  some  rate  which  is  dependent  on  the  percent  of  the  population  that  already  has  the 
information,  the  density  of  the  social  network,  and  other  graph-level  network  metrics.  The  ap¬ 
proach  is  perhaps  accurate  in  the  aggregate  but  we  lose  the  subtlety  and  nuance  that  explicitly 
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representing  complex  networks  of  people  provides.  For  most  social  network  simulation  needs, 
the  system  dynamics  approach  is  not  the  modeling  framework  of  choice  and  is  only  used  to  talk 
about  overall  change  in  the  structural  parameters  of  networks  such  as  the  change  in  density  but 
does  not  produce  specific  new  networks  of  who  is  interacting  with  whom. 

9.1.2  Statistical  Network  Generation 

Both  parametric  and  non-parametric  statistical  methods  have  been  applied  to  learning  and  infer¬ 
ring  models  of  social  networks. 

For  parametric  approaches:  Random  Graph  Models  provide  a  statistical,  data  driven  mechan¬ 
ism  for  social  network  simulation.  These  models  are  derivative  from  graph  theory  or  have  been 
observed  in  real  world  networks.  Networks  are  generated  randomly  using  edge  generation  func¬ 
tions.  Edges  in  social  network  do  not  exist  or  not  exists;  rather  they  have  some  probability  of  ex¬ 
istence.  This  probability  is  modeled  by  a  named  parametric  distribution  like,  Poisson,  Exponen¬ 
tial,  or  Power  Law.  Each  of  these  distributions  comes  with  a  set  of  simplifying  assumptions  that 
may  or  may  not  be  appropriate  for  the  phenomenon  being  modeled.  Optimal  parameters  for  these 
edge  models  are  empirically  derived  using  expectation  maximization  or  maximum  likelihood 
estimation.  However,  due  to  the  complexity  of  networks,  the  state  space  of  these  systems  is  mas¬ 
sive  making  direct  solving  of  the  likelihood  function  intractable.  This  requires  clever  heuristic 
approximations  to  find  near-optimal  parameter  values  rather  than  the  most  optimal  parameter 
values.  Random  graph  models  have  been  used  to  simulate  collaboration  and  affiliation  models.  It 
is  worth  noting  that  these  statistical  approaches  are  typically  aimed  at  the  simulation  of  topologi¬ 
cal  formation  and  have  much  less  complexity  and  much  less  to  say  from  a  sociological  viewpoint 
than  their  agent  based  counterparts. 

For  statistical  models  that  have  a  stronger  sociological  basis  we  look  toward  P*  models,  oth¬ 
erwise  known  as  Exponential  Random  Graph  Models  (ERGM).  These  models  are  based  upon 
Markov  random  graphs  and  represent  a  logistic  regression  of  the  network  parameterized  by  vari¬ 
ous  network  statistics  such  as  reciprocity,  transitivity,  centralization,  connectedness  and  others. 
Using  a  pseudo-likelihood  function,  P*  models  are  fit  to  observed  networks.  This  model  can  then 
be  sampled  to  produce  simulations  of  the  observed  social  network.  Tools  like  Sienna,  developed 
by  Tom  Snijders,  can  be  used  to  fit  ERGMs  to  data. 

There  are  also  non-parametric  approaches  to  social  network  simulation;  one  example  is  the 
Multi-Regression  Quadratic  Assignment  Procedure,  or  MRQAP.  MRQAP  uses  multiple  samples 
from  the  social  network  being  studied  to  perform  a  regression  analysis  of  dyadic  information  that 
is  correlated.  Since  properties  of  transience,  reciprocity,  and  homophily  are  generally  assumed  to 
exist  within  social  networks,  most  dyadic  links  have  significant  correlation  with  one  another. 
This  autocorrelation  would  normally  be  a  significant  issue  for  regression  analysis  but  MRQAP 
uses  a  permutation  procedure  to  account  for  the  autocorrelation.  MRQAP  produces  a  regression 
model  of  social  relationships  that  can  be  useful  for  running  hypothesis  tests  on  networks;  this 
method  can  be  significantly  affected  by  bias  learned  in  the  model. 


9.1.3  Agent  Based  Models 

One  of  the  most  commonly  used  and  intuitive  approaches  to  SNS  is  Agent  Based  Models  (ABM) 
(see  agent-based  models).  ABMs  employ  a  bottom  up  approach  in  which  a  set  of  heterogeneous 
agents,  their  behavioral  properties,  the  “rules”  of  interaction,  the  environment  and  the  interaction 


150 


topology  that  the  agent  populates  is  explicitly  modeled.  Complex  social  behavior  emerges  from 
simple  individual  level  processes.  In  ABMs  many  computational  entities,  with  varying  levels  of 
cognitive  complexity,  interact  with  one  another  in  a  manner  similar  to  the  real  world  entities  they 
represent.  These  agents  are  simplified  versions  of  their  real  life  counterparts  (e.g.,  ants,  people, 
robots,  or  groups),  only  retaining  elements  salient  to  the  phenomena  being  studied.  Agents  inte¬ 
ract  in  a  virtual  world  and  can  be  constrained  and  enabled  by  the  network  position  they  occupy. 

In  most  ABMs  the  topology  of  the  virtual  world  is  a  simple  2-D  grid  and  agents  form  “net¬ 
works”  as  they  occupy  the  same  or  neighboring  spaces  or  the  agent’s  network  is  prescribed  as  the 
set  other  agents  within  so  many  spaces  of  ego.  Networks  generated  from  grid-based  interactions 
or  defined  in  terms  of  grid-nearness  tend  not  to  have  the  same  properties  as  true  social  networks; 
i.e.,  the  distribution  of  ties,  the  method  of  tie  formation  and  dissolution,  and  the  relation  of  ties  to 
physical  space  are  not  realistic.  Most  ABM  toolkits  support  this  type  of  grid-based  modeling  of 
the  social  topology. 

There  is,  however,  a  growing  interest  in  and  a  growing  number  of  ABMs  where  the  agents 
exist  and  move  in  a  socio-demographic  or  network  topology  rather  than  a  grid  topology.  An  ex¬ 
ample  here  is  the  Construct  model.  In  these  models  the  agents  occupy  a  social  network  position 
defined  in  terms  of  which  other  agents  ego  can  interact  with.  In  other  words,  rather  than  physical 
adjacency,  social  adjacency  is  used.  This  network  topology  may  be  static  or  dynamic.  This  latter 
type  of  model  where  agents  exist  in  dynamic  social  networks  rather  than  on  grids  is  where  most 
research  on  SNS  is  focusing.  This  is  the  approach  we  found  to  be  most  valuable  for  modeling  the 
adversary  and  it  is  embodied  in  Construct. 

9.1.4  Relational  Sources  of  Complexity  in  ABM  SNS 

Social  network  simulation  has  a  deliberate  and  expected  preoccupation  with  relational  informa¬ 
tion.  The  space  in  which  people  interact  is  a  social  one,  there  may  be  geographic  motivations  for 
communication,  but  these  considerations  merely  temper  and  constrain  the  social  space.  As  such, 
for  the  virtual  spaces  in  the  ABM  SNS,  agents  interact  in  a  social  space  where  every  agent  is  po¬ 
tentially  adjacent  to  all  others. 

Using  populations  of  virtual  individuals,  network  effects  emerge  from  both  intended  and  un¬ 
intended  interaction  among  agents  connected  by  ties  of  varying  strength.  The  strength  of  the  tie 
between  two  agents  is  defined  in  terms  of  frequency  of  interaction  or  strength  of  social  tie  or  de¬ 
gree  of  similarity.  Agent  behavior,  when  the  network  is  dynamic,  can  change  the  strength  of  this 
tie.  Moreover,  these  ties  may  be  hierarchically  organized;  e.g.,  two  agents  may  interact  and  that 
interaction  may  be  a  work-based  interaction  and  that  interaction  may  be  further  characterized  as 
interaction  vis  a  specific  task. 

The  mechanisms  that  drive  interactions  in  an  ABM  SNS  are  typically  based  in  social  theory. 
Theories  of  human  interaction  such  as  homophily,  transitivity,  reciprocity  are  coupled  with  basic 
or  sophisticated  cognitive  abilities.  Theories  of  interaction  take  into  account  both  social,  emo¬ 
tional,  and  cognitive  processes.  Hence  the  cognitive  load  on  the  agent  to  determine  whom  to  in¬ 
teract  with  when  can  be  quite  high  increasing  the  demand  both  for  more  storage  and  more  com¬ 
putational  processing  power. 

Another  source  of  complexity  is  the  over-lapping  social  circles.  Since  the  agents  are  socially 
embedded,  the  social  environment  itself  may  be  characterized  in  multiple  ways.  For  example, 
agents  might  be  tied  by  different  forms  of  similarity  -  age,  gender,  ethnicity,  attendance  at  com- 
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mon  events  or  co-location,  shared  resources,  shared  knowledge  or  beliefs,  various  role  based  re¬ 
lations  -  kinship,  mentorship,  leadership,  and  through  diverse  media  -  face-to-face,  email,  web. 
The  result  is  that  the  agents  occupy  a  multi-dimensional  topology. 

Finally,  agents  are  not  just  embedded  in  social  networks.  Rather,  they  are  connected  in  trails 
of  who  was  where  when  doing  what  with  what  information  or  resources  and  for  what  effect.  That 
is  underlying  any  SNS  that  deals  with  socio-cognitive  actors  (hence  not  the  simple  statistical 
models)  there  will  be  an  ecology  of  interlinked  networks.  This  is  referred  to  as  the  Meta-Network 
-  a  multi-mode,  multi-link,  multi-level  network  of  networks  at  multiple  points  in  time.  For  most 
ABM  SNS  the  classes  of  nodes  will  include:  Who  (people,  teams,  organizations);  What  (tasks, 
events);  How  (knowledge,  resources);  Why  (beliefs);  and  Where  (locations).  By  formalizing 
these  entities  we  are  able  to  explicitly  get  at  unique  relationships  between  them  implicit  in  mul¬ 
timodal  data.  A  network  of  people-to-organizations  is  an  affdiation  network,  while  a  network  for 
knowledge-to-tasks  is  a  Needs  network,  and  agent-to-agent  networks  are  the  familiar  social  net¬ 
work  formalization.  A  meta-network  approach  allows  the  developer  to  more  fully  represent  and 
formalize  relationships  present  in  the  real  world  that  drive  social  interaction.  For  example,  if  a 
person  is  driven  to  interact  with  another  person  because  they  have  to  complete  a  particular  task, 
and  this  particular  task  requires  they  know  something  specific  but  they  don’t  have  this  know¬ 
ledge  then  they  have  to  go  to  a  resource  (book)  or  another  person  to  gain  the  knowledge  required. 

These  five  key  sources  of  complexity  are  completely  connected  network  (full  adjacency), 
hierarchical  interaction,  cognitive  load,  high  dimensionality  of  and  overlap  in  the  social  space, 
and  meta-network  considerations.  These  factors  dramatically  increase  the  complexity  of  social 
network  simulation  over  many  traditional  agent  based  simulations.  These  factors  also  reduce  the 
size  of  populations  that  can  be  simulated  and  increase  the  computational  resources  needed  to  si¬ 
mulate  the  system.  ABMs  have  been  used  to  model  incredibly  large  populations,  e.g.,  millions  of 
agents.  Parallelizing  activity  makes  this  possible.  However,  when  accurate  network  representa¬ 
tions  are  added  as  in  the  SNS  models  rather  than  just  deriving  the  network  from  grid-based  inte¬ 
ractions,  standard  approaches  to  parallelization  are  no  longer  possible. 

9.1.5  Common  Research  Challenges 

Two  core  challenges  are  reuse  and  validation.  Reuse  is  the  process  of  taking  an  existing  model 
and  with  no  change  to  the  internal  processes  reuse  the  model  with  different  input  data  to  address 
a  new  situation.  An  example  would  be  to  use  a  model  of  information  diffusion  to  first  explore 
how  best  to  communicate  medical  information  to  effect  change  in  smoking  behavior  and  then 
reuse  it  to  explore  how  to  intervene  in  the  social  network  to  effect  world  leader’s  understanding 
of  global  climate  change.  Currently,  most  models  are  one-off  model  and  require  sufficient  re¬ 
building  and  extension  for  new  problems.  SNS  models,  however,  are  a  potential  exception.  In 
SNS  models,  these  models  can  be  built  to  take  as  input  one  or  more  real-world  networks.  The 
SNS  models  can  then  be  used,  on  any  network  data  set,  to  identify  the  probability  of  alternative 
futures  and  the  impact  of  various  interventions.  A  core  advance  in  this  area  has  been  the  devel¬ 
opment  of  support  technologies  to  generate  networks  from  socio-demographic  data,  such  as  cen¬ 
sus  data,  as  import  to  ABM  SNS  (see  e.g.,  the  work  on  BioWar).  For  adversarial  modeling  we 
enabled  reuse  by  augmenting  Construct  so  that  it  could  take  meta-network  data  directly  from 
ORA.  This  is  described  in  the  later  modeling  chapter  and  was  used  with  the  Indo-Pak  scenario. 

Validation  of  any  socio-cultural  simulation  is  difficult.  The  core  reasons  are  that  these  mod¬ 
els  violate  all  the  assumptions  that  underlie  validation  theory  due  to  being  comprised  of  agents 
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that  leam.  In  the  SNS  area,  the  challenges  are  further  compounded  by  the  lack  of  spatio-temporal 
network  data  and  by  the  fact  that  human  lab  experiments  are  inappropriate  as  network  effects  do 
not  show  up  without  groups  greater  than  5. 

For  ABMs  the  key  validation  approach  is  to  do  validation  in  parts  and  to  validate  each  me¬ 
chanism  separately.  The  hope  is  that  by  validating  the  pieces,  some  confidence  is  bestowed  to  the 
whole.  The  problem,  is  little  is  known  about  the  conditions  under  which  this  is  true  for  a  com¬ 
plex  non-linear  system. 

Docking  and  model-to-model  comparison  is  a  key  validation  strategy.  This  process  involves 
showing  that  for  two  or  more  models,  common  inputs  produce  common  outputs.  This  allows  a 
simulation  that  has  not  been  formally  validated  to  gain  validation  from  an  older  simulation  which 
has  been  validated  and  sheds  light  on  the  elements  of  the  models  that  are  robust.  This  model-to- 
model  approach  is  part  of  the  multi-modeling  approach  used  in  this  MURI. 

For  the  statistical  models  like  ERGM,  P*  and  MRQAP  the  models  have  been  “trained”  on 
real  data.  In  this  case,  validation  is  the  process  of  seeing  whether  the  predictions  hold  in  the  fu¬ 
ture  or  in  other  time  periods.  For  these  models  generalizability  is  more  of  a  concern  if  the  models 
learned  are  ported  to  other  reasonably  equivalent  systems. 

9.1.6  Applications 

Common  uses  of  SNS  range  from  theoretical  investigation  to  applied  analysis  and  prediction 
tasks.  Researchers  can  explore  the  ramifications  of  sociological  principles  like  homophily  and 
transitivity:  are  these  mechanisms  sufficient  to  produce  real  networks  that  we  observe?  What  are 
the  properties  of  analysis  methods  and  are  they  robust?  In  applied  settings  SNS  can  assist  in  pre¬ 
dicting  how  a  network  will  evolve  and  help  analyze  the  dynamic  equilibriums  that  might  arise. 
Key  application  areas  are  the  spread  of  disease,  information  diffusion,  belief  formation  and  dif¬ 
fusion,  and  activity  contagion.  SNS  are  critical  for  understanding  the  impact  of  various  interven¬ 
tions  where  social  influence  is  expected  to  play  a  role.  Here  we  use  them  to  assess  adversarial 
groups.  In  particular  we  used  agent-based  dynamic-network  models,  specifically  Construct. 


9.2  Agent-Based  Dynamic-Network  Models 

Agent-based  modeling  is  a  simulation  technique  which  relies  on  the  capabilities  of  individual 
actors,  called  agents,  in  order  to  model  a  global  behavior.  In  an  agent-based  model  (ABMs) 
complex  system  level  behavior  emerges  from  the  local  action  of,  and  interaction  among,  a  large 
number  of  heterogeneous  agents.  The  relationships  between  agents,  the  social  and  spatial  topolo¬ 
gy  in  which  agents  are  embedded,  and  the  logic  that  guides  agent  behavior  play  a  crucial  role  in 
determining  the  overall  behavior  of  the  system.  Global  outcomes  emerge  as  heterogeneous 
agents  interact  and  engage  in  various  local  activities. 

There  are  a  number  of  advantages  to  investigating  a  research  problem  by  building  or  extend¬ 
ing  an  agent-based  model.  All  simulation  techniques,  including  agent-based  modeling,  are  key 
tools  for  theory  development  as  they  force  researchers  to  encode  their  assumptions  when  writing 
models  and  to  question  previously  hidden  assumptions  in  theories.  This  process  allows  a  re¬ 
searcher  or  policymaker  to  realize  the  limitations  of  a  particular  theory  or  solution,  or  conversely 
to  develop  extensions  of  a  theory  into  a  new  domain  or  to  develop  a  solution  that  is  more  robust. 
When  building  an  agent-based  model,  the  simulation  designer  will  have  full  control  over  what 
types  of  data  will  be  gathered,  and  can  be  modified  relatively  easily  if  follow-up  virtual  experi- 
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ments  are  performed.  The  data  gathered  will  not  be  subject  to  the  kinds  of  cognitive  or  methodo¬ 
logical  biases  found  in  empirical  research.  Virtual  experiments  performed  using  agent-based 
models  may  be  more  ethical  than  those  using  people,  especially  if  the  experiment  requires  radical 
or  harmful  reorganization  of  the  actors  involved.  The  size  of  agent-based  virtual  experiments  can 
also  be  much  larger  than  those  performed  using  traditional  human  subjects,  and  the  marginal  cost 
of  adding  an  extra  actor  or  even  an  entire  replication  can  be  trivial.  Simulation  can  also  be  used 
to  examine  the  same  starting  condition  multiple  times,  allowing  the  researcher  to  perform  a 
‘what-if  analysis  as  random  changes  build  up  and  cause  the  simulated  population  to  evolve  dif¬ 
ferently.  Simulation  can  also  be  used  predicatively  in  order  to  forecast  what  would  happen  to  a 
specific  initial  condition;  when  run  multiple  times,  broad  trends  may  be  detected  and  outlying 
cases  and  their  causes  potentially  identified.  Lastly,  by  leading  the  researcher  to  think  about  the 
kinds  of  local  rules  that  lead  to  global  patterns  or  by  forcing  the  researcher  to  confront  the  unin¬ 
tended  consequences  of  seemingly  individual  rules,  agent-based  modeling  can  help  a  researcher 
understand  the  link  between  individual  and  social  behavior. 

Agent-based  modeling,  like  other  technique,  has  its  strengths  and  limitations.  These  models 
are  particularly  valuable  for  comparing,  contrasting  and  combing  theories  about  how  individuals 
act  and  so  serve  as  a  virtual  world  for  developing  theory  by  both  exploring  theory  interactions  as 
well  as  generating  and  testing  hypotheses.  They  are  valuable  when  there  are  not  strong  empirical 
regularities  relating  the  past  to  the  future  as  they  allow  discovery  of  the  space  of  possibilities. 
ABMs  are  tools  for  gaining  intuition  about  how  individual  differences  can  have  systemic  global 
consequences.  Finally,  ABMs  enable  experimental  protocols  to  be  examined  and  the  likely  con¬ 
sequences  estimated  using  virtual  experiments  when  the  same  experiment  is  too  complex,  costly, 
technologically  infeasible  or  unethical  to  run  in  the  real-world.  Agent-based  modeling  also  has  a 
number  of  weaknesses.  These  models  often  have  a  vast  number  of  parameters  and  so  must  be  run 
a  large  number  of  times  in  order  to  appropriately  explore  the  parameter  space.  This  can  create 
analytic  difficulties.  Validation,  as  will  be  discussed,  may  be  difficult.  Many  ABMs  are  built 
with  rules  specific  to  a  narrow  domain  and  so  have  to  be  significantly  rebuilt  to  be  used  in  a  dif¬ 
ferent  domain.  ABMs  can  require  vast  quantities  of  computational  resources,  particularly  if  very 
high  fidelity  agents  are  used. 

ABMs  are  distinct  from  other  mathematical  or  modeling  techniques  such  as  closed-form  so¬ 
lutions,  discrete  event  simulations,  and  system  dynamics  models.  While  ABMs  are  agent  fo¬ 
cused,  the  other  techniques  are  population  focused.  Closed-form  solutions  are  mathematical 
transformations  which  attempt  to  find  an  exact  (and  optimal)  solution  to  a  particular  problem 
when  expressed  mathematically;  while  such  solutions  may  be  found  for  certain  simple  problems, 
they  are  often  not  applicable  for  the  complex  and  often  inexact  problems  that  agent-based  models 
are  used  to  address.  In  contrast  ABMs  are  concerned  with  the  process  and  not  on  some  optimal 
or  final  state.  Discrete-event  simulations  focus  the  design  of  the  model  around  events,  usually 
organizing  the  simulation  around  an  event  queue;  however,  these  events  need  not  be  generated 
by  actors  themselves.  ABMs  can  take  as  input  event  sequences  but  add  individual  rules  of  beha¬ 
vior  to  respond  to  such  events.  System  dynamics  models  focus  on  aggregate  behaviors  in  a  socie¬ 
ty,  and  as  such  attempt  to  express  the  number  of  agents  who  have  a  particular  trait  without  com¬ 
pletely  specifying  the  agents  themselves.  Both  system  dynamic  models  and  ABMs  are  complex 
system  models.  The  key  difference  is  that  the  logic  for  social  change  is  that  system  dynamic 
models  are  top-down  whereas  ABMs  are  bottom  up.  From  an  environment  perspective  in  an 
ABM,  the  environment,  such  as  the  social  network,  is  represented  explicitly;  in  contrast,  the  oth¬ 
er  models  represent  the  environment  using  summary  statistics  such  as  density.  As  a  result,  only 
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an  ABM  can  explore  the  explicit  flow  of  ideas,  beliefs,  influence,  trust,  disease,  money  etc. 
though  the  network  as  agents  interact  and  get  as  output  the  specific  network  and  which  agent  has 
what  when. 

9.2.1  Agents  and  Their  Environment  (and  Social  Network) 

ABMs  vary  in  how  the  environment  is  represented.  This  could  be  as  simple  as  a  single  dimen¬ 
sion  or  array  and  so  ego  interacts  with  those  other  agents  that  are  within  so  many  squares  left  or 
right  of  ego.  This  is  the  case  in  Kaufman’s  NK  model.  Traditionally,  however,  the  environment 
was  a  grid  and  the  agents  interacted  with  other  agents  in  and/or  could  move  to  those  squares  that 
surrounded  them.  Most  early  studies  explored  the  relative  impact  of  von  Neuman  (squares  left, 
right,  up,  down  of  ego)  or  Moore  (eight  squares  around  ego)  or  extended  Moore  neighborhoods 
(squares  within  some  distance  of  ego).  In  these  traditional  approaches  the  structure  of  the  social 
network  is  directly  tied  to  the  physical  position  of  the  agents.  Examples  of  such  models  are  the 
game  of  life,  the  original  Schelling  segregation  model  and  the  more  recent  SugarScape  models 
developed  by  Epstein  and  Axtell.  In  general,  it  is  difficult  to  get  realistic  social  networks  in  this 
representation  of  the  environment.  Further,  as  early  results  showed,  unless  the  grid  is  bent  into  a 
torus,  the  resultant  social  behavior  is  largely  dictated  by  “edge  effects’’;  i.e.,  restrictions  on  ac¬ 
tivity  caused  by  being  at  the  edge  of  the  physical  grid. 

More  advanced  models  place  agents  in  a  socio-demographic  space  and  separate  the  physical 
and  the  social  space.  In  such  models,  very  few  have  explicitly  modeled  the  social  network.  In¬ 
creasingly,  however,  researchers  are  incorporating  more  realistic  network  representations,  such 
as  small-world,  scale-free,  or  other  types  of  network  generators.  The  most  advanced  of  these 
models  are  the  dynamic-network  ABMs  in  which  the  networks  and  the  agents  co-evolve  (the  first 
model  of  this  type  was  Construct).  In  some  cases,  the  models  are  instantiated  with  networks  that 
are  actually  derived  from  real  data.  These  models  will  often  generate  or  import  an  appropriate 
graph  before  the  simulation  agents  are  initialized,  and  then  assign  each  agent  to  a  graph  position 
when  the  simulation  starts.  Other  models  use  a  social  network  gathered  from  empirical  studies. 
These  networks  have  the  advantage  of  being  as  realistic  as  possible,  but  may  potentially  bias  the 
simulation  results  due  to  the  structure  and  nature  of  the  particular  social  network  gathered  (see 
social  network  simulation).  Correctly  specifying  the  topology  of  a  social  network  in  an  agent- 
based  model  has  important  implications  for  the  conclusions  drawn.  In  modeling  the  adversary  it 
is  valuable  to  use  the  social  network  of  the  adversarial  group. 

The  quality  of  the  social  network  modeling  can  have  important  effects  on  simulation  out¬ 
comes.  For  instance,  in  the  Construct  model,  the  social  network  topology  has  a  non-linear  effect 
on  knowledge  and  belief  diffusion  rates  in  the  system.  Construct  uses  sophisticated  agents  that 
have  the  ability  to  interact  and  choose  partners  with  which  to  exchange  knowledge  and  belief  A 
stylized  meta-network,  which  specifies  the  pattern  of  potential  partners  with  which  an  agent  can 
interact,  can  be  imposed  to  limit  the  form  of  the  evolved  networks.  We  use  Construct  to  model 
the  adversary.  Our  results  indicate  that  the  most  effective  type  of  intervention  depends  on  how 
the  adversary  is  structured;  e.g.,  A1  Qaeda  and  Hamas  have  different  structures  and  the  same  in¬ 
tervention,  such  as  isolation  of  the  top  leader,  in  the  two  cases  can  lead  to  performance  decre¬ 
ments  in  one  and  performance  improvements  in  the  other. 

9.2.2  Trade-offs 

When  building  an  ABM,  particularly  an  agent-based  dynamic-network  model,  researchers  should 
be  aware  of  the  key  trade-offs.  One  important  trade  off  is  between  simplicity  and  realism.  Simple 
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models,  such  as  Schelling’s  segregation  model,  attempt  to  use  a  specific  principle  to  describe  an 
important  trend  in  human  or  social  behavior.  By  keeping  the  principle  narrow,  the  modeler  seeks 
to  illustrate  how  a  particular  phenomenon  has  important  explanatory  power.  Such  models  are  ex¬ 
tremely  valuable  for  engaging  systematic  thinking  in  an  area  and  for  making  key  points  to  an  au¬ 
dience.  However,  the  results  generated  by  using  such  models,  however,  tend  to  be  quite  fragile 
and  can  change  radically  as  new  types  of  agents,  alternative  environments,  or  additional  interac¬ 
tion  logics  are  added.  In  contrast,  more  expressive  models  are  more  veridical  and  by  capturing 
greater  realism  are  capable  of  explaining  a  wider  swath  of  human  socio-cultural  behavior.  The 
more  expressive  emulative  models  often  employ  multiple  modules,  as  well  as  an  extremely  large 
number  of  parameters,  in  order  to  increase  their  accuracy  and  predictive  power.  This  increase  in 
power  and  fidelity,  however,  comes  at  the  cost  of  ease  of  explanation,  time  to  generate  results, 
and  time  to  analyze  model  results.  Another  important  trade-off  is  between  the  sophistication  of 
each  agent  and  the  number  of  agents  in  the  model.  In  general,  the  more  sophisticated  the  cogni¬ 
tive  model  the  fewer  the  number  of  agents  represented.  Models  with  a  larger  number  of  agents 
typically  employ  simpler  agents  with  fewer  rules  such  as  in  the  artificial  life  simulations;  in  con¬ 
trast,  models  with  only  a  few  agents  typically  employ  quite  sophisticated  cognitive  agents  capa¬ 
ble  of  actually  doing  tasks,  e.g.,  flying  planes,  as  in  tac-air-SOAR.  The  reason  is  simple: 
processing  and  run-time  constraints  are  such  that  increasing  either  the  number  or  the  cognitive 
sophistication  of  the  agents  increases  computational  costs.  There  are  two  source  of  complexity  in 
the  agent  model:  cognitive  and  social.  The  more  sophisticated  the  cognitive  model  the  more  the 
ABM  can  be  used  to  explore  behavior  on  specific  tasks,  such  as  buying  groceries.  The  more  so¬ 
phisticated  the  agent’s  social  model,  the  more  it  can  be  used  to  address  issues  of  socio-cultural 
change  and  information  diffusion.  Both  cognitive  and  social  complexity  increase  computational 
processing  costs.  Historically,  ABM  designers  with  more  emulative  models  have  either  worked 
with  a  few  (less  than  a  hundred)  very  realistic  cognitive  agents,  or  a  moderate  number  (less  than 
25,000)  of  very  realistic  social  agents  that  are  moderately  cognitively  realistic,  or  millions  of 
agents  that  are  both  cognitively  and  socially  simplistic.  A  further  trade-off  occurs  between  over¬ 
all  model  sophistication  and  speed.  Not  only  will  more  complex  models  take  longer  to  run  due  to 
their  more  complex  computer  logic,  but  they  will  also  take  a  substantial  amount  of  time  to  code, 
debug,  and  process  results.  Simple  models,  on  the  other  hand,  will  run  faster  but  may  be  more 
limited  in  their  output.  As  a  result,  the  more  sophisticated  the  model,  the  more  likely  it  is  built, 
maintained,  and  extended  by  a  team  whereas  the  simple  model  may  be  built  by  a  single  research. 

9.2.3  Validation  and  Verification 

Validation,  or  the  alignment  between  the  model’s  behavior  and  actual  empirical  data,  is  a  major 
concern  and  is  a  criticism  often  levied  against  simulation  models  of  socio-cultural  systems. 
Though  models  are  often  criticized  for  insufficient  validation,  the  type,  scope,  extent,  and  preci¬ 
sion  of  validation  depends  on  the  data  available,  the  type  of  model  built,  and  the  expected  use  of 
the  model’s  predictions.  More  validation  is  not  always  better;  extremely  basic  models  are  rarely 
validated  as  their  purpose  is  illustration,  and  some  models  need  not  be  validated  at  all.  On  the 
other  hand,  emulative  models  rarely  can  be  validated  using  a  single  case  scenario  and  conse¬ 
quently  the  researcher  needs  to  fuse  data  from  a  wide  variety  of  sources  -  often  at  different  time 
scales  and  collected  for  diverse  purposes  -  to  obtain  a  “good  enough’’  dataset  for  validation. 

ABMs  of  socio-cultural  systems  present  special  challenges  to  validation  and  analysis.  One 
cannot  naively  assume  that  if  the  basic  model  of  a  single  agent  is  validated  then  the  aggregate 
model  is  valid,  as  interaction  effects  may  lead  to  very  different  behavior.  Typically  models  are 


156 


validated  at  either  the  individual  agent  or  the  collective  level  but  not  both.  When  compared  to 
engineering  models  of  physical  systems,  these  socio-cultural  ABMs  have  more  variables,  high 
covariance  among  variables,  discontinuities  in  variables,  and  non-stationary  processes,  interac¬ 
tion  effects  and  temporal  variations  in  the  relations  among  variables  often  due  to  learning.  As 
such,  the  nature  of  socio-cultural  ABMs  violates  basic  assumptions  about  the  nature  of  simula¬ 
tion  models  that  underlie  the  traditional  formal  approaches  to  analysis  and  validation  developed 
in  engineering  and  the  physical  sciences.  This  means  that  a  new  science  of  validation  is  needed, 
and  that  socio-cultural  ABMs  should  not  be  used  to  predict  the  future  but  to  describe  the  space  of 
future  possibilities.  Given  these  complexities,  new  approaches  to  validation  in  this  area  have 
emerged:  validation  by  parts  (validating  individual  sub-modules),  validation  of  inputs,  validation 
of  processes,  and  validation  by  docking.  The  process  of  docking  two  models,  whereby  the  results 
of  one  model  are  compared  to  that  of  another,  enables  a  greater  understanding  of  what  factors 
make  the  model  results  robust  and  identifies  common  failings.  Moreover,  common  results  from 
divergent  models,  as  we  found  in  the  Indo-Pak  scenario  enhance  the  likelihood  of  the  overall 
finding. 

9.3  Construct 

For  modeling  the  adversary  we  extended  and  used  the  Construct  model.  Key  extensions  were 
enabling  reusability  by  allowing  the  model  to  be  instantiated  by  ORA,  geo-spatial  diffusion 
modeling,  and  multi-intervention  analysis.  Over  the  course  of  the  MURI  a  large  number  of  stu¬ 
dies  were  done.  These  included:  analysis  of  basic  adversarial  forms,  impact  of  alternative  COA 
related  to  both  agent  isolation  and  knowledge  promulgation,  and  assessment  of  best  approach  for 
effecting  belief  change,  i.e.,  “winning  the  minds  and  hearts  of  the  adversary.” 

Construct  3.5  -  hereafter  referred  to  as  simply  Construct  -  is  a  multi-agent  dynamic-network 
simulation  model  for  examining  the  co-evolution  of  agents  and  the  socio-cultural  environment 
[109],  [188].  Using  Construct,  one  can  examine  the  evolution  of  networks  and  the  processes  by 
which  information  moves  around  a  social  network  [189],  [190].  Construct  captures  dynamic  be¬ 
haviors  in  groups,  organizations  and  populations  with  different  cultural  and  technological  confi¬ 
gurations  [191].  In  Construct,  groups  and  organizations  are  complex  systems.  The  variability  of 
human,  technological  and  organizational  factors  among  such  systems  are  captured  through  hete¬ 
rogeneity  in  information  processing  capabilities,  knowledge,  and  resources.  Multiple  non- 
linearities  in  the  system  generate  complex  temporal  behavior  on  the  part  of  the  agents. 

Construct  is  the  embodiment  of  constructuralism,  a  mega-theory  which  states  that  the  socio¬ 
cultural  environment  is  continually  being  constructed  and  reconstructed  through  individual 
cycles  of  action,  adaptation  and  motivation.  Many  social  science  theories  and  findings  are  part  of 
the  constructural  theoretical  approach  including  structuration  theory  [192],  social  information 
processing  theory  [193],  symbolic  interactionism  [194],  [195],  social  influence  theory  [196], 
cognitive  dissonance  [197],  and  social  comparison  [198].  In  addition  a  number  of  cognitive 
processes  are  embedded  such  as  transactive  memory  [199]. 

There  are  three  key  features  of  Construct  3.5  that  make  it  ideal  for  our  purposes.  First,  the 
experiment  designer  has  complete  control  over  which  sub-agent  models  are  used  for  interaction 
over  the  course  of  a  run.  Second,  Construct  contains  a  suite  of  agent  models  which  enable  di¬ 
verse  socio-technical  conditions  to  be  modeled.  Third,  general  agent  characteristics  can  be  easily 
configured  a  priori  using  empirical  data  or  they  can  be  based  on  hypothetical  data.  To  use  Con- 
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struct,  as  we  did  in  this  work,  the  researcher  specifies  both  the  relevant  agents  [200]  and  the  so¬ 
cial  and  knowledge  networks  [201]. 

While  additional  information  about  the  Construct  interaction  model  can  be  found  elsewhere 
(e.g.,  [109],  [190]),  the  core  Construct  agent  dynamics  are  as  follows. 

Each  time  period  of  the  simulation,  agents  take  a  variety  of  actions  including  initiating  an  in¬ 
teraction,  responding,  sending  messages,  engaging  in  tasks,  updating  beliefs.  For  each  agent, 
these  action  tend  to  occur  cyclically  except  for  responding  to  media  and  making  decisions  which 
may  occur  off  cycle  -  see  Fig.  9.1.  Exactly  which  actions  an  agent  can  take,  and  how  many  can 
be  done  simultaneously,  depends  on  the  agent’s  socio-cognitive  nature.  Each  action  takes  a  cer¬ 
tain  amount  of  time,  typically  a  time  period.  Human  agents  use  their  preference  for  homophily  or 
expertise,  their  transactive  memory  of  other  agents’  knowledge,  their  beliefs,  their  socio¬ 
demographic  characteristics,  their  availability,  and  their  recommendations  from  others  in  order  to 
rank  the  importance  of  interacting  other  agents  in  their  social  network.  Based  on  this  ranking,  the 
human  agent  may  choose  to  initiate  communication  with  one  or  more  other  agents.  The  type  of 
agent  -  human,  web-page,  etc  -  will  determine  whether  the  agent  can  initiate  interaction  and 
what  are  the  agent’s  information  processing  characteristics. 
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Fig.  9.1  Cycle  of  Agent  Activity 

If  two  agents  are  able  to  interact  and  communicate,  then  both  agents  will  prepare  a  message 
and  send  it  to  the  other.  A  message  is  a  set  of  memes  [202],  and  so  consists  of  one  or  more  in¬ 
stance  of  any  or  all  of  the  following:  knowledge,  beliefs,  transactive  memory  about  the  know¬ 
ledge  of  third  parties,  or  transactive  memory  about  the  beliefs  of  third  parties.  Once  prepared,  the 
message  is  communicated  to  the  interaction  partner,  where  it  may  be  modified,  misinterpreted,  or 
ignored  based  on  the  socio-cognitive  properties  of  the  receiver.  After  receiving  a  message, 
processing  it,  and  possibly  learning  from  it,  both  parties  may  modify  their  beliefs  or  make  any 
relevant  decisions.  This  process  then  repeats  for  each  agent  during  each  time  period. 

All  agents  operate  in  the  same  “time  frame”  meaning  that  interventions  and/or  interrupts  can 
occur  at  a  particular  time  and  all  agents  can  respond  to  it  -  e.g.,  a  news  add  can  come  out  at  time 


158 


period  3,  and  agents  will  respond  during  that  time  period  and  other  periods  when  the  interrupt  or 
intervention  is  active.  Statistics,  outputs,  and  decision  information  are  gathered  relative  to  these 
the  time  periods,  as  well  as  at  the  end  of  the  simulation. 

Although  Construct  was  originally  developed  as  a  pure  lock- stepped  model  with  each  agent 
interacting  each  time  period  and  then  updating  their  memory,  that  is  no  longer  the  case.  As  of 
version  2.5,  Construct  includes  event  driven  mechanisms,  variable  duration  interaction,  and  fixed 
as  well  as  mutable  agent  characteristics.  In  addition  to  these  programming  changes  to  update 
Construct  with  newer  simulation  technology,  additional  work  has  performed  done  on  validating 
the  core  mechanisms  independent  of  the  exact  technological  mechanism  in  a  variety  of  settings. 
Finally,  the  current  version  is  multi-threaded. 

The  fundamental  mechanisms  in  Construct  have  been  scientifically  validated  [188],  [203], 
[204],  [205].  It  has  been  used  to  explain  group  mobilization  [188],  the  impact  of  leadership 
[206],  and  the  impact  of  the  printing  press  [207].  Directly  germane  to  the  current  study,  Con¬ 
struct  has  been  used  to  compare  and  contrast  different  educational  media  by  socio-demographic 
feature  [208]  and  the  impact  media  and  opinion  leaders  in  real  cities  [209]. 

9.3.1  Agents 

Agents  are  decision-makers  with  varying  information  processing,  socio-demographic,  and  access 
constraints  and  as  such  may  or  may  not  be  human  [152].  Within  Construct,  agents  go  about  their 
business  interacting,  communicating  and  learning  each  time  period,  as  described  in  Fig.  9.1.  As 
agents  learn  or  acquire  information,  they  may  change  their  preferred  interaction  partners  and 
modify  what  they  are  likely  to  communicate.  These  factors,  in  turn,  influence  what  types  of  deci¬ 
sions  are  made  by  each  agent.  A  variety  of  factors  influence  who  agents  select  as  interaction 
partners,  what  they  communicate  with  that  partner,  how  much  and  how  they  communicate, 
whether  they  learn  anything  from  that  partner,  and  the  accuracy  and  sustainability  of  that  learn¬ 
ing.  Such  factors  include  the  agent’s  socio-demographic  characteristics,  information  processing 
characteristics,  proximity,  and  current  position  in  the  social  and  knowledge  networks.  The  agent 
model  has  been  described  in  depth  in  other  venues  (e.g.,  [188],  [200],  [201];  thus,  we  concentrate 
here  on  both  a  high  level  description  and  details  of  those  components  used  for  the  simulations 
reported. 

Within  Construct,  agents  both  influence  and  are  influenced  by  others.  Agents  who  have  in¬ 
fluence  over  others  can  use  that  influence  to  escalate  or  de-escalate  activity  at  a  societal  level  by 
communicating  information  and/or  beliefs.  Social  influence  -  as  derives  from  shared  attributes 
such  as  socio-demographic  factors,  shared  knowledge,  beliefs,  and  proximity  -  co-evolves  with 
the  spread  of  knowledge  and  beliefs  [109].  Consequently,  in  more  heterogeneous  populations 
where  the  lines  of  differentiation  line  up  the  chance  of  self-  reinforcing  beliefs  at  the  group  level 
is  greater  [210].  Factors  that  are  not  influenced  by  the  diffusion  of  information  and  beliefs  in¬ 
clude  the  agent’s  socio-demographic  role  (e.g.,  age,  race,  gender,  level  of  education),  the  agent’s 
basic  cognitive  limitations  and  information  processing  capabilities  (e.g.,  likelihood  of  forgetting, 
risk  taking,  amount  of  information  and  beliefs  that  can  be  communicated  or  processed,  and 
whether  the  agent  has  transactive  memory),  the  size  of  their  sphere  of  influence  (at  least  in  the 
short  term),  and  factors  that  have  resulted  from  socio-cognitive  interactions  (e.g.,  literacy,  access 
to  newspapers,  radio  and  the  internet). 

Within  Construct,  agents  develop  likelihoods  of  interacting  with  others  based  on  relative  si¬ 
milarity  (RS)  and  relative  expertise  (RE)  [211],  [200].  Relative  similarity  is  a  homophilly  based 
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mechanism  [212],  [109]  and  derives  from  the  idea  that  individuals  are  more  likely  to  interact  if 
they  have  more  in  common.  Homophilly  based  interaction  is  a  multi-causal  phenomenon  due  to 
ease  of  communication,  shared  understandings,  and  comfort.  The  relative  similarity  of  i  and  j, 
from  i’s  perspective,  is  characterized  as 

“  I.J<lI.k<K(AKik*AKjk-) 

where  individual  i’s  relative  similarity  to  j,  is  determined  in  terms  of  socio-demographics,  know¬ 
ledge,  and  belief  items  K  in  the  agent-to-knowledge  matrix  AK. 

Of  important  note:  an  individual  is  most  relatively  similar  to  itself,  and  each  period  will  have 
a  reasonably  high  probability  of  choosing  to  “interact  with  itself’  and  to  avoid  communicating 
with  others.  Just  because  an  agent  has  the  highest  relative  similarity  with  itself,  however,  does 
not  mean  that  an  agent  will  always  interact  with  itself;  indeed,  due  to  the  large  number  of  other 
agents  in  the  simulation,  such  avoidance  of  communication  is  relatively  rare. 

Relative  expertise  is  a  search  based  mechanism  and  derives  from  the  idea  that  individuals  are 
more  likely  to  interact  if  one  has  information  that  the  other  wants.  The  relative  expertise  of  j  as 
judged  by  i  is  characterized  as 


if  AKik  =  0,  ti^en  Xj^  =  AKj^  else  Xj^  =  0 

_  I!fc<x  ^jk 
y  Y  X 

Zj j<I  2^k<K  ^jk 

where  individual  i’s  relative  similarity  to  j,  is  determined  in  terms  of  socio-demographics, 
knowledge,  and  belief  items  K  in  the  agent-to-knowledge  matrix  AK  [213]. 

Agents  are  more  likely  to  initiate  interaction  with  another  if  they  think  the  other  has  informa¬ 
tion  they  need  and/or  they  are  similar  to  them.  However,  there  is  a  curvilinear  relation  between 
this  familiarity  and  expertise;  to  wit,  as  agents  initially  increase  in  similarity  (homophily)  they 
are  more  likely  to  realize  the  other  has  expertise  they  need  but  as  they  increase  still  further  in  si¬ 
milarity  they  realize  that  the  other  is  so  similar  there  is  no  specialized  expertise. 

The  researcher  needs  to  specify  the  strength  of  each  of  these  factors  for  agent-agent  interac¬ 
tion.  Herein,  we  set  all  human  agents  to  use  both  logics  and  to  at  any  time  create  a  combined 
probability  of  interaction  that  is  based  on  60%  similarity  and  40%  expertise.  In  both  cases,  indi¬ 
viduals  are  giving  and  receiving  information  and  the  overall  tendency  to  give  versus  receive  is 
about  60/40  as  identified  by  Valente,  Poppe  and  Merritt  [214]. 

When  setting  up  a  virtual  experiment  in  Construct  the  researcher  needs  to  specify  multiple 
parameters  for  each  agent.  This  is  often  facilitated  by  the  used  of  agent  classes  to  parameterize 
multiple  agents  simultaneously.  Specifically,  the  agent  needs  to  specify  the  number  of  agents  in 
each  of  the  classes  of  agents  in  a  virtual  experiment,  the  distribution  of  socio-demographic  para¬ 
meters  for  the  agents  of  that  class,  the  distribution  of  cognitive  factors  for  each  class,  the  sphere 
of  influence  for  that  class,  and  the  access  constraints  for  that  class.  There  are  many  other  factors 
that  can  be  varied,  such  as  the  rate  of  forgetting.  However,  we  have  found  that  for  modeling  the 
adversary  the  items  listed  are  the  core  variables  that  need  to  be  defined. 
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9.3.2  Agent  Classes 

In  this  study,  we  find  it  helpful  to  think  in  terms  of  two  meta-elasses  of  agents  -  human  agents 
and  media  agents  (whieh  may  or  may  not  be  human).  Each  time  period,  human  agents  may  inte¬ 
ract  with  other  members  of  the  general  human  population  or  with  a  media  agent.  Sometimes,  it  is 
useful  to  further  break  the  general  public  into  subgroups  such  as  red,  green  and  blue,  or  terrorists, 
harboring  population  and  US  forces. 

There  are  two  classes  of  human  agents:  the  general  public,  who  will  make  decisions,  and  the 
opinion  leader,  who  can  help  sway  decisions.  In  the  experiments  performed,  the  opinion  leader 
attempts  to  get  the  general  public  to  act  in  one  way  while  the  media  are  designed  to  thwart  it. 

In  this  experiment,  we  consider  five  classes  of  media  agents:  newspaper  advertisements  (ad), 
publically  accessible  web  sites  (web),  centers  that  have  people  in  them  that  provide  assistance 
when  someone  comes  in  physically  or  calls  in  via  phone  (call),  radio  advertisements  (radio),  and 
letters  sent  via  postal  mail  (mail).  Media  agents  differ  from  each  other  in  terms  of  the  time  pe¬ 
riods  they  are  active  and  the  length  of  the  messages  they  send.  All  agents  can  communicate  facts 
or  beliefs,  but  the  particular  set  transmitted  depends  on  their  knowledge  or  belief  at  the  time.  All 
media  agents  are  passive  -  they  cannot  initiate  communication  with  a  human  agent.  Instead,  they 
provide  information  only  when  the  human  agent  selects  to  go  to,  listen  to,  or  read  the  information 
available  through  the  media. 

These  particular  media  agents  were  chosen  because  they  represent  distinct  forms  of  access  to 
information.  You  might  ask  why  we  did  not  use  television  when  it  is  so  prevalent.  The  reason  is 
that,  within  the  characteristics  we  were  varying  television  and  radio  ads  are  identical.  Thus  one 
can  think  of  radio  as  radio/television  ads. 

The  number  of  each  type  of  agent,  their  activity  level  and  length  of  messages  sent  needs  to  be 
defined.  Table  9.1  provides  an  example. 

The  initial  knowledge  and  beliefs  held  by  each  of  the  media  agents  and  the  general  public  at 
the  beginning  of  the  simulation  need  to  be  defined.  See  Table  9.2  for  an  example.  Note  the  user 
can  specify  one  or  more  beliefs  and  for  each  define  the  distribution  of  knowledge.  Over  the 
course  of  the  simulation,  the  general  public,  i.e.,  the  agents  representing  humans,  learns;  howev¬ 
er,  the  knowledge  of  the  opinion  leader  and  the  media  remains  constant.  The  number  of  facts  in 
each  category,  specified  in  the  left-hand  column  of  the  table,  is  proportioned  based  on  subject- 
matter  expert’s  views  of  the  relative  amount  of  time  it  takes  for  the  overall  meta-concept  -  such 
as  know-how  for  a  task  -  to  diffuse. 

In  order  for  a  human  agent  to  make  a  decision,  an  agent  must  recognize  that  the  activity  ex¬ 
ists,  must  have  sufficient  know-how  knowledge,  and  hold  a  positive  view  of  one  of  the  two  be¬ 
liefs.  In  order  to  have  sufficient  know-how  information,  agents  must  learn  at  least  three  of  the  six 
know  how  facts;  considering  that  agents  do  not  start  with  any  of  this  information,  they  must  learn 
it  from,  ultimately,  the  opinion  leader  or  media.  Additionally,  we  have  modeled  two  beliefs  here 
-  one  where  the  true  belief  is  that  one  shouldn’t  engage  in  the  activity  (believe  not  right),  and 
one  that  is  neutral  as  to  whether  there  is  some  benefit  to  engaging  in  the  activity  (believe  worth 
doing).  In  order  to  make  the  decision,  agents  must  hold  at  least  as  many  positive  beliefs  as  nega¬ 
tive  beliefs,  or  they  must  be  subject  to  social  influence  from  their  peers  which  convinces  them 
that  the  decision  is  a  good  one.  Each  activity  modeled  would  have  a  set  of  beliefs  associated  with 
it. 
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TABLE  9.1  A  table  illustrating  how  a  user  can  characterize  different  classes  of  agents  by  speci¬ 
fying  their  number,  activity,  and  message  capabilities. 


Class 

Number 

Periodicity 

Active  Time 
Periods 

Message  Length 

Humans 

3000 

Continuous 

104 

1  fact,  belief,  transactive  fact  or 
belief,  or  social  information 

Opinion  Leader 

1 

Periodic  every  other  time 
period 

52 

1  fact,  belief,  or  transactive  fact 
or  belief,  or  social  information 

Ad 

1 

New  news  ads  are  peri¬ 
odic 

26 

1-2  facts  or  beliefs 

Web 

1 

Periodic  access  every 
other  time 

52 

4  facts  or  beliefs 

Call 

1 

Periodic  access  every 
fourth  time 

26 

3  facts  or  beliefs 

Radio 

1 

New  ads  are  periodic 

1  (per  ad) 

1-2  facts  or  beliefs 

Mail 

26 

Periodic  new  mail 

6 

3  facts  or  beliefs 

TABLE  9.2  A  table  illustrating  how  a  user  can  characterize  a  population  by  differentially  distri¬ 
buting  information  and  beliefs  across  classes  of  agents. 


Information  and 
Beliefs 

General 

Human 

Population 

Opinion 

Leader 

Media  Agents 

Ad 

Web 

Call 

Radio 

Mail 

Activity  exists 
(1  fact) 

0% 

100% 

100% 

100% 

100% 

100% 

100% 

Activity  know-how 
(6  facts) 

0% 

100% 

10% 

33% 

10% 

10% 

10% 

Believe  right 
(3  facts) 

1% 

100% 

0% 

0% 

0% 

0% 

0% 

Believe  not  right 
(4  facts) 

5% 

0% 

33% 

100% 

100% 

33% 

33% 

Believe  worth 
doing 
(3  facts) 

1% 

100% 

0% 

0% 

0% 

0% 

0% 

Believe  not  worth 
doing 
(3  facts) 

5% 

0% 

33% 

100% 

100% 

33% 

33% 

General  knowledge 
(500  facts) 

20% 

20% 

10% 

2% 

5% 

10% 

10% 

The  more  facts  per  category  -  and  hence  the  more  complex  the  message  -  the  longer  it  takes 
that  category  as  a  meta-concept  to  diffuse.  However,  it  is  important  to  note  that  all  information 
related  to  the  activity  (twenty  total  facts)  is  small  relative  to  the  amount  of  simulated  general 
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knowledge  (five  hundred  facts)  so  that  most  of  the  time  the  general  population  will  not  be  com¬ 
municating  facts  about  the  activity.  Furthermore,  the  ratio  of  positive  and  negative  facts  asso¬ 
ciated  with  the  belief  influences  whether  the  “correcf  ’  belief  is  positive,  negative  or  neutral.  We 
have  two  beliefs  here  -  one  where  the  true  belief  is  that  one  shouldn’t  engage  in  the  activity,  and 
one  that  is  neutral  as  to  whether  there  is  some  benefit  to  engaging  in  the  activity.  Finally,  the 
amount  of  information  associated  with  activity  know-how  and  with  any  one  belief  is  comparable 
so  that  both  spread  in  a  comparable  amount  of  time.  The  more  complex  the  know-how  and  the 
more  complex  the  belief  the  longer  that  information  will  take  to  spread  and  the  lower  the  fraction 
of  the  population  that  will  have  the  expertise  or  belief  at  any  one  time. 

The  advertisement  is  meant  to  provide  a  small  amount  of  knowledge  and  belief  while  also 
containing  a  large  amount  of  general  knowledge  information  to  encourage  agents  to  examine  it. 
Such  behavior  is  typical  of  articles  or  advertisements  in  newspapers.  Advertisements  only  exist 
for  a  few  time  periods  during  the  simulation,  reflecting  relative  infrequent  publication.  Adver¬ 
tisements  can  be  expected  to  have  a  small  impact  on  a  variety  of  agents  due  to  the  infrequent  in¬ 
teraction  and  small  message  conveyed;  however,  they  will  be  among  the  most  common  media 
that  human  agents  access.  Since  the  advertisement  is  in  printed  media,  it  can  be  subject  to  two 
different  constraints:  a  cognitive  constraint,  literacy,  and  an  access  constraint,  subscription 
access. 

In  contrast  to  the  advertisement,  the  web  site  is  designed  to  provide  a  large  amount  of  belief 
information  by  proving  a  large  number  of  reasons  why  the  activity  is  inappropriate.  In  doing  so, 
however,  it  could  potentially  be  scraped  for  knowledge  information,  thus  serving  a  purpose  that 
is  contrary  to  what  the  designers  intended.  For  this  reason,  resources  such  as  the  website  can  be 
two-edged  swords.  Because  the  website  is  frequently  available,  it  will  be  easily  accessed;  how¬ 
ever,  users  accessing  it  may  have  literacy  or  internet  access  issues. 

The  information-call-center  is  designed  to  answer  questions  about  the  activity,  based  on  re¬ 
quests  for  information  from  those  members  of  the  general  population  who  contact  the  center.  Be¬ 
cause  the  information-center  represents  the  actions  of  humans  who  work  at  the  center  it  has  asso¬ 
ciated  with  it  more  social  knowledge  then  the  web  site.  Unlike  the  web-site,  though  it  may  be 
difficult  to  get  to  the  center  as  it  requires  physical  movement  and  thus  may  not  be  as  favorable  an 
interaction  partner  to  some  agents. 

The  radio  advertisement  is  very  similar  the  print  advertisement.  It  is  designed  to  provide  a 
small  amount  of  information  or  beliefs  but  can  reach  a  large  number  of  agents  in  the  general 
population.  Unlike  the  advertisement,  however,  the  radio  advertisement  is  not  affected  by  the 
literacy  or  access  constraints  as  modeled  in  this  experiment. 

The  postal  mailing  is  designed  to  represent  a  piece  of  mail  containing  information  meant  to 
deter  at-risk  agents  from  engaging  in  the  activity  in  question.  It,  too,  has  the  same  information 
content  as  the  advertisement,  but  the  way  the  general  population  interacts  with  it  is  unique.  Only 
some  “human”  agents  receive  mail.  However,  whether  or  not  the  “human”  agent  reads  the  mail  is 
up  to  the  individual  agent.  For  the  next  six  time  periods,  the  mail  message  resides  in  the  agent's 
“mailbox”.  The  general  population  agent  then  has  a  certain  probability  of  checking  their  mail  and 
learning  the  information  in  the  letter.  Agents  who  read  the  letter  absorb  some  of  the  information 
contained  in  the  letter. 

To  date,  a  large  number  of  media  have  been  modeled.  In  general,  we  tended  to  model  media 
known  to  be  used  by  the  adversary  and/or  US  forces. 
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9.3.3  Agent  Socio-Demographics 

In  Construct,  agents  can  have  a  set  of  non-evolving  attributes  that  influence  behavior.  Herein,  we 
consider  those  attributes  to  be  socio-demographic  characteristics.  These  attributes  can  be  set 
based  on  census  data,  or  based  on  other  considerations.  The  researcher  can  in  fact  define  any 
characteristics  as  agent  attributes  and  then  use  these  to  effect  interaction.  The  critical  difference 
between  attributes  and  knowledge/beliefs  is  that  for  an  agent  the  attributes  are  fixed  for  the  dura¬ 
tion  of  the  simulation;  in  contrast,  the  agent’s  knowledge  and  beliefs  may  change.  Consequently, 
attribute  based  interaction  tends  to  be  stable,  and  variations  in  interaction  are  due  to  changes  in 
knowledge  and  beliefs. 

The  user  can  define  any  attributes  that  make  sense  within  the  socio-cultural  context  being 
modeled.  One  possibility  is  to  base  this  off  of  population  demographics.  The  socio-demographic 
attributes  are  used  to  set  the  baseline  interaction  that  exists  independently  of  agent  knowledge. 
The  greater  the  overlap  in  agent  socio-demographic  attributes,  the  more  likely  the  agents  will 
interact,  as  part  of  the  homophily  effect  [215].  Table  9.3  shows  an  example  of  attribute  setting 
using  a  set  of  ubiquitous  general  aspects  of  human  behavior. 

Two  classes  of  agents,  general  public  human  agents  and  opinion  leaders,  have  these  socio¬ 
demographic  attributes.  Media  agents  could  be  “targeted”  so  that  they  were  aimed  to  “match” 
and  so  interact  with  humans  with  different  attributes.  Specifically,  media  were  designed  to  target 
the  agents  who  had  either  the  lowest  or  second-lowest  level  of  income  and  education.  Thus,  the 
opinion  leaders  and  media  would  match  any  agent  who  had  one  of  those  two  attribute  values,  but 
would  not  match  any  other  agent.  These  attributes  were  oversampled  in  the  human  agent  popula¬ 
tion  relative  to  the  general  population  of  the  United  States  in  order  to  better  understand  the  ef¬ 
fects  of  the  cognitive  limitations,  and  information  processing  capabilities. 

TABLE  9.3:  A  table  illustrating  how  the  user  can  differentiate  agents  by  varying  the  socio¬ 
demographics. 


Attribute 

Number  of 
Values 

Values  (%  of  Human  Agent  Population) 

Age 

5 

0-29(20%);  30-39(20%);  40-49(20%), 

50-64  (20%),  65+  (20%) 

Gender 

2 

Male  (50%); 

Female  (50%) 

Race 

5 

White  (60%);  African-American  (15%); 

Hispanic  (10%);  Asian  (10%);  Other  (5%) 

Income 

6 

0-15k  (40%);  15k-30k  (35%);  30k-50k  (15%); 

50k-80k  (6%);  80k- 120k  (3%);  120k+  (1%) 

Parent 

2 

Yes  (50%); 

No  (50%) 

Education 

4 

Less  than  high  school  (40%);  High  school  diploma  (35%); 

College  degree  (30%);  Graduate  schooling  (1%) 

The  correlation  between  these  attributes  is  also  an  important  consideration.  Population  level 
correlations  could  have  been  generated  in  one  of  three  ways:  1)  proportional  to  census  data,  2) 
randomly,  or  3)  evenly.  Results  can  vary  dramatically  with  the  socio-demographic  distribution. 
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9.3.4  Agent  Cognitive  Limitations  and  Information  Processing  Capabilities 

Construct  agents  are  complex.  Two  core  features  of  Construct  agents  are  information  processing 
capabilities  and  transactive  memory.  Agents  are  information  processing  decision  makers  and  so 
have  one  or  more  of  these  capabilities:  initiate  interaction,  send  messages,  receive  messages, 
learn  from  messages.  Agents  can  have  both  general  and  transactive  memory  [199].  An  agent’s 
general  memory  can  contain  both  what  information  the  agent  knows  -  its  facts  -  and  what  beliefs 
it  agent  holds.  The  transactive  memory,  on  the  other  hand,  contains  the  agent’s  understanding  of 
third  parties  -  who  knows  what  and  believes  what.  This  transactive  memory  can  be  incorrect:  the 
third  party  might  not  know  the  knowledge  or  hold  the  belief.  Who  knows  what,  as  well  as  who 
knows  who  knows  what,  can  be  tracked  by  time  period. 

Agents  make  decisions  as  to  whether  or  not  to  engage  in  activities  based  on  their  current 
knowledge  and  beliefs.  These  decisions  require  various  information  and  beliefs,  such  as:  infor¬ 
mation  on  how  to  do  the  activity,  a  belief  that  the  agent  should  do  the  activity,  and  a  belief  that 
the  activity  is  appropriate.  The  point  here  is  that  there  is  a  mask  on  information  and  beliefs  such 
that  different  information  and  beliefs  are  needed  for  different  decisions.  In  addition,  for  this 
study,  decisions  are  made  at  the  final  time  period  based  on  accumulated  information  and  beliefs. 

However,  agents  differ  in  their  information  processing  constraints.  In  this  study  we  use  the 
following  factors:  amount  of  information  and  beliefs  that  can  be  communicated  or  processed  at  a 
time,  whether  the  agent  has  transactive  memory,  and  whether  the  agent  can  initiate  interaction  or 
learn.  These  factors  are  set  differently  for  each  agent  class.  In  Table  9.4  illustrative  distribution 
of  cognitive  capabilities  per  agent  class  are  described.  In  Table  9.5  illustrative  distribution  of  the 
information  processing  capabilities  per  agent  class  are  described.  Other  possible  factors  that  we 
can  consider  in  the  future  are  forgetting  and  risk-taking. 


TABLE  9.4  A  table  illustrating  how  the  user  can  differentiate  agents  based  on  constraints. 


Factors 

General 

Population 

Human 

Opinion 

Leader 

Media  Agents 

Ad 

Web 

Call 

Radio 

Mail 

Access  Con¬ 
straints 

Literacy, 

Web, 

Newspaper 

None 

None 

None 

None 

None 

None 

Number  of 
messages  re¬ 
ceived  and 
processed  at 
the  same  time 

1 

None 

None 

None 

None 

None 

None 

Number  of 
messages  sent 
at  same  time 

1 

unli¬ 

mited 

unlimited 

unli¬ 

mited 

unli¬ 

mited 

unli¬ 

mited 

unli¬ 

mited 

9.3.5  Networks 

Construct  is  a  multi-agent  dynamic-network  simulation  system  in  which  the  agents  are  con¬ 
strained  and  enabled  by  their  position  in  a  meta-network.  A  meta-network  defines  the  set  of  rela¬ 
tions  among  who,  what,  how  why  through  a  set  of  geo-temporal  trails  [152],  [216].  As  such,  a 
meta-network  is  a  multi-mode,  multiplex,  multi-level  network.  Consequently,  in  Construct, 
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agents  are  embedded  in  a  large  number  of  networks,  including  formal  and  informal  relations 
among  agents,  relationships  between  agents  and  knowledge,  and  assignments  of  knowledge  and 
beliefs  to  tasks.  From  a  meta-network  perspective  the  key  entity  classes  in  Construct  are  agents, 
knowledge  or  expertise,  beliefs,  and  tasks.  Thus  the  core  networks  are  the  social  network  among 
agents,  the  knowledge  network  (agents  to  knowledge),  the  beliefs  network  (agents  to  belief),  the 
assignment  network  (agents  to  tasks),  and  the  requirements  network  (knowledge  +  beliefs  to 
tasks).  Within  this  the  social  network  can  be  further  broken  down  in  to  a  proximity  based  net¬ 
work,  a  socio-demographic  based  network  and  a  knowledge/belief  based  network. 

TABLE  9.5  A  table  illustrating  how  to  define  agent  classes  by  varying  the  information 
processing  capabilities  of  the  agents  in  that  class. 


Factors 

General 

Population 

Human 

Opinion 

Leader 

Media  Agents 

Ad 

Web 

Call 

Radio 

Mail 

Initiate 

Yes 

Yes 

No 

No 

No 

No 

No 

Send 

Yes 

Yes 

Yes 

Yes 

Yes 

Yes 

Yes 

Receive 

Yes 

Yes 

No 

No 

No 

No 

No 

Decide  to  take 
action 

Yes 

No 

No 

No 

No 

No 

No 

Learn 

Yes 

No 

No 

No 

No 

No 

No 

Change  beliefs 

Yes 

No 

No 

No 

No 

No 

No 

Information 

Atrophy 

No 

No 

No 

No 

No 

No 

Yes 

Message  Com¬ 
plexity 

Very  Low 

Very  Low 

Low 

High 

Med 

Low 

Med 

Supports  mul¬ 
tiple  searches 

Yes 

Yes 

Yes 

Yes 

No 

No 

Few 

Additionally,  Construct  allows  the  experiment  designer  to  set  networks  as  fixed  or  dynamic 
during  the  simulation.  Moreover,  the  initial  topology  of  such  networks  can  be  specified.  This 
enables  the  impact  of  topology  to  be  studied  at  the  same  time  as  the  impact  of  information-based 
media.  In  this  study,  parts  of  the  social  network  are  fixed  based  on  demographics  and  parts  dy¬ 
namic  based  on  changing  expertise.  The  result  is  that  the  overall  probability  of  interaction  be¬ 
tween  each  dyad  is  dynamic.  In  this  paper,  both  knowledge  networks  and  belief  networks,  were 
dynamic  and  would  change  over  the  course  of  the  simulation. 

The  social  network  is  of  particular  interest  to  this  study.  Empirical  studies  of  social  networks 
often  form  a  network  by  asking  individuals  for  the  names  of  their  interaction  partners.  The  result 
is  a  snapshot  of  a  network  at  a  point  in  time  as  it  is  perceived.  Based  on  this  perspective  it  is 
tempting  to  think  of  networks  as  simple  binary  relations,  two  individuals  either  are  or  are  not 
connected.  Simulation  makes  it  obvious  that  the  idea  of  a  network  is  more  amorphous. 

In  Construct  there  are  a  number  of  ways  to  characterize  the  network  of  possible  agent-agent 
interactions.  All  agents  exist  in  a  social  network,  and  in  this  network  the  links  among  agents  are 
probabilistic.  These  probabilities  evolve  over  time,  changing  as  agents  increase  in  similarity  and 
expertise.  At  any  point  in  time,  who  is  interacting  with  whom  can  be  extracted  in  multiple  ways: 
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as  a  moving  average,  as  probabilities,  as  a  number  of  interactions  in  one  particular  time  period  , 
and  as  whether  an  interaction  occurred  from  the  beginning  of  the  simulation  to  that  point. 

In  designing  the  simulation,  the  sphere  of  influence  -  the  alters  with  which  an  ego’s  probabil¬ 
ity  of  interaction  is  nonzero  -  is  the  set  of  others  who  the  agent  is  likely  to  interact  with.  In  the 
full  Construct  model  this  sphere  can  grow  and  shrink;  however,  in  this  study  we  leave  it  fixed. 
Agents  with  greater  reach  -  such  as  the  opinion  leader  -  have  a  larger  sphere  of  influence,  while 
most  human  agents  have  a  relatively  small  one.  Constraints  on  information  access,  as  will  be  de¬ 
scribed,  can  impact  the  effective  size  of  an  agent’s  sphere  of  influence  by  making  certain  types 
of  agents  inaccessible.  The  size  of  the  sphere  of  influence  per  agent  class  is  described  in  Table  6; 
both  the  theoretical  maximum  is  provided  and  the  “in-practice”  value  determined  from  the  expe¬ 
riments  run.  Note,  the  opinion  leader  is  in  every  general  human  agent’s  sphere  of  influence.  Ad¬ 
ditionally,  for  each  human  agent  whether  or  not  an  media  agent  is  in  the  human  agent’s  sphere  of 
influence  depends  on  whether  or  not  the  human  agent  has  an  access  constraint  that  prevents  inte¬ 
raction. 

In  Table  9.6,  demonstrates  the  distinction  between  the  theoretical  maximum  size  of  the 
sphere  as  well  as  the  in  practice  value.  The  network  underlying  the  sphere  of  influence  is  de¬ 
signed  exogenously  by  the  experimenter  prior  to  the  start  of  the  run.  However,  the  actual  sphere 
of  influence  in  practice  is  the  set  of  partners  with  whom  the  individual  agent  interacts  due  to  ho- 
mophily,  expertise,  or  socio-demographic  similarity.  Since  agents  often  do  not  interact  with  all  of 
their  potential  partners,  the  effective  size  of  the  interaction  sphere  in  practice  is  often  much 
smaller  than  the  theoretical  maximum. 

TABLE  9.6  A  table  illustrating  the  way  in  which  the  user  can  adapt  the  agent  classes  by  spe¬ 
cifying  the  size  of  the  sphere  of  influence  per  class. 


Factors 

General 

Population 

Human 

Opinion 

Leader 

M 

ledia  Agents 

Ad 

Web 

Call 

Radio 

Mail 

Sphere  of  Influ¬ 
ence  Theoreti¬ 
cal  Maximum 

40±10 

3000 

3000 

3000 

3000 

3000 

3000 

Sphere  of  Influ¬ 
ence  in  Practice 

25±10 

250±50 

300±75 

100±50 

66±20 

250±100 

150±50 

For  each  pair  of  agents,  the  probability  that  they  interact  is  a  function  of  proximity,  socio¬ 
demographics,  knowledge,  beliefs,  and  the  interaction  logic.  Since  the  socio-demographics  re¬ 
mained  constant  in  this  study,  the  overall  probability  of  interaction  contains  both  a  fixed  and  a 
non-fixed  component.  Since  these  overall  probabilities  can  change,  we  say  that  the  social  net¬ 
work  is  evolving  as  who  actually  interacts  with  whom  will  vary  over  the  simulation  run:  the  inte¬ 
raction  partners  of  the  early  simulation  periods  will  differ  substantially  from  those  of  the  later 
periods.  This  evolution  can  be  observed  in  the  changing  likelihoods  that  the  agent  has  for  inte¬ 
racting  with  those  in  its  sphere  of  influence;  however,  the  size  of  the  sphere  of  influence  and  the 
topology  of  the  fixed  portion  of  these  probabilities  do  not  change.  Thus,  as  the  probability  of  in¬ 
teraction  increases  for  any  pair  of  agents,  that  increase  must  come  relative  to  that  of  other  agents 
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in  the  interaction  sphere  and  must  mean  that  both  agents  are  evolving  to  become  relatively  less 
similar  to  all  other  possible  interaction  partners. 

Using  Construct  a  number  of  different  topologies  for  the  fixed  portions  of  these  networks  can 
be  examined.  They  can  be  random  [217],  cellular  [218],  or  small  world  [219],  [220].  The  accura¬ 
cy  of  the  simulated  topology  is  extremely  dependent  on  number  of  agents  and  the  overall  density. 
For  example,  with  10  agents  and  a  density  of  0.5  it  is  not  possible  to  cannot  get  a  cellular  net¬ 
work  -  agents  are  too  interconnected  to  exhibit  cellular  structures;  similarly,  a  network  with  100 
agents  and  a  density  of  1.0  is  not  random,  cellular  or  small  world  as  everyone  is  uniformly  con¬ 
nected  to  anyone.  When  the  populations  have  more  than  3000  agents,  the  selected  densities  and 
sphere  of  interaction  sizes  should  be  selected  to  ensure  that  the  topologies  examined  are  good 
representations  of  that  topology;  i.e.,  truly  random,  cellular  or  small  world. 

The  key  differences  in  the  random,  small-world  and  cellular  network  are  clustering  and  the 
ratio  of  internal  to  external  ties.  In  a  random  network  the  links  are  distributed  independently  and 
identically.  These  are  the  general  fixed  communication  links.  In  the  small-world  network,  each 
agent  has  a  few  links  and  a  few  agents  have  many  links.  In  contrast,  in  a  cellular  network  the 
agents  are  clustered  in  to  a  few  cells  and  mostly  communicate  with  other  cell  members  while  on¬ 
ly  one  or  two  members  per  cell  interact  with  anyone  in  another  cell.  The  placement  of  these  ties 
affects  the  diffusion  of  information  throughout  the  society  and  has  the  potential  to  lead  to  differ¬ 
ent  rates  of  diffusion  among  and  between  different  agents. 

9.3.6  Constraints  on  Information  Access 

Cognitive  and  social  factors  combine  to  determine  the  level  of  information  access  that  individu¬ 
als  may  have.  We  examine  three  different  information  access  mechanisms:  literacy,  internet 
access,  and  newspaper  readership  [221].  Within  Construct,  these  access  mechanisms  affect 
whether  agents  can  interact  with  a  specific  media  and  get  information  through  a  specific  forum. 
These  mechanisms  are  implemented  as  “switches”  that  the  researcher  can  enable  or  not,  depend¬ 
ing  on  the  research  question. 

In  Construct,  agents  can  be  literate  or  not,  as  set  by  an  experimenter-controlled  switch.  The 
literacy  mechanism  affects  all  media  that  require  reading  printed  material.  This  means  that 
printed  advertisement  in  newspapers,  web  site,  and  information  sent  in  letters  via  the  postal  sys¬ 
tem  are  affected.  When  literacy  as  an  information  access  parameter  is  enabled,  illiterate  agents 
can  still  access  these  media;  however,  they  do  not  learn  all  the  information  and  beliefs  conveyed 
in  the  message  and  they  may  even  mis-learn  information.  A  small  level  of  mis-leaming  is  im¬ 
plemented  as  the  literature  on  literacy  shows  that  literacy  is  in  part  a  matter  of  degree  which  of¬ 
ten  leads  the  illiterate  individual  to  misinterpret  what  is  being  read.  Literate  agents  are  unaffected 
by  enabling  the  literacy  mechanism,  and  receive  the  full  information  from  these  media.  When  the 
mechanism  is  disabled,  all  agents  receive  the  full  information. 

In  Construct,  agents  can  surf  the  web  or  not  -  and  those  that  do  have  access  to  internet-based 
media.  When  the  internet  access  constraint  is  enabled,  agents  lacking  web  access  cannot  read  in¬ 
formation  posted  on  web  sites  at  all.  Agents  with  internet  access  can  read  such  information,  and 
use  this  information  to  affect  subsequent  interactions  with  other  non-web  agents.  When  the  me¬ 
chanism  is  disabled,  all  agents  can  read  information  from  web  sites. 

In  Construct,  agents  also  have  the  ability  to  read  newspapers  and  access  the  information  con¬ 
tained  in  them.  The  newspaper  access  mechanism  affects  all  media  that  require  physical  new- 
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sprint  such  advertisements  in  newspapers  and  specialized  articles  by  opinion  leaders.  When 
newspaper  access  is  enabled,  agents  lacking  newspaper  subscriptions  cannot  read  articles  pub¬ 
lished  in  the  paper.  Agents  who  are  newspaper  readers,  though,  can  still  read  such  information. 
When  the  mechanism  is  disabled,  all  agents  can  read  information  printed  in  newspapers. 

It  is  important  to  note  that  these  mechanisms  interact.  For  example,  if  an  agent  is  illiterate 
and  has  a  newspaper  subscription,  that  agent  may  read  the  news  articles  but  do  so  with  error.  On 
the  other  hand,  if  an  agent  is  literate  but  does  not  have  access  to  the  internet,  they  still  cannot 
read  web-pages  (and  the  literacy  parameter  has  no  effect). 

For  each  agent  class,  the  researcher  must  exogenously  specify  whether  or  not  an  access  con¬ 
straint  applies,  and  the  probability  that  an  agent  in  that  class  is  constrained.  In  this  study  access 
constraints  only  apply  to  general  public  human  agents.  That  is  neither  the  opinion  leader  nor  the 
media  agents  are  constrained.  In  this  study,  the  probability  that  an  agent  is  illiterate,  cannot 
access  the  web,  or  does  not  read  a  newspaper  was  derived  from  socio-demographic  attributes  and 
national  averages.  A  series  of  formulas,  one  for  each  constraint,  that  determine  the  probability 
that  the  agent  is  constrained  based  on  age  and  education  were  derived  from  national  data  (see 
[221]  for  details). 
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Chapter  10 


Adversary  Modeling  -Applications  of  Dynamic  Network  Analysis 

Kathleen  M.  Carley,  Il-Chul  Moon,  Geoffrey  Morgan,  Michael  Lanham 


10.1  Introduction 

This  chapter  focuses  on  the  general  utility  of  dynamic  network  analysis  for  adversary  modeling 
and  presents  a  brief  survey  of  a  various  modeling  efforts.  The  tools  discussed  in  the  previous 
three  chapters,  Automap,  ORA,  and  Construct,  help  their  users  to  perform,  among  other  tasks, 
various  kinds  of  dynamic  network  analysis. 

Dynamic  network  analysis  (DNA)  focuses  on  the  theory  and  design  of  dynamic  networks 
among  diverse  entities,  and  the  study  of  all  phenomena  emerging  from,  enabled  by,  or  con¬ 
strained  by  such  networks.  Entities  include  both  actors,  such  as  robots  and  humans,  and  artifacts, 
such  as  events  or  resources.  DNA  focuses  on  developing  theory  around  the  creation  and  main¬ 
tenance  of  such  networks,  on  developing  plausible  and  useful  models,  on  measuring  changes  in 
networks,  and  on  evaluating  these  found  networks. 

Because  DNA  is  indeed,  dynamic,  changes  over  time  are  a  critical  and  novel  aspect  of  the 
science  that  distinguishes  it  from  the  larger  body  of  network  science  and  social  network  analysis. 
A  practitioner  of  DNA,  with  the  appropriate  data,  can  answer  all  five  journalistic  questions: 
Who?,  What?,  Why?,  How?,  and  When?. 

It  has  become,  with  state  of  the  art  tools  and  good  data,  routine  to  answer  questions  such  as: 

•  Who  are  the  Key  Actors? 

•  What  resources  are  critical  to  this  network? 

•  What  locations  are  critical  to  this  network? 

•  Who  are  the  leaders  in  this  group? 

•  How  likely  are  tasks  given  to  this  network  to  be  performed  well? 

But  these  questions  are  mostly  static,  developing  good  methods  of  answering  questions  about 
the  dynamics  of  the  network  is  one  of  the  principal  research  areas.  Advances  in  this  field  are  and 
would  allow  questions  such  as  these  to  be  answered: 

•  Has  the  group  changed,  and  how? 

•  Has  an  individual’s  role  changed? 

•  Are  new  groups  forming? 

•  Are  the  sub-units  different? 

But  answering  these  kinds  of  questions  is  difficult,  not  only  because  quantifying  change  is  a 
hard  problem,  but  because  data  is  usually  incomplete  and  almost  always  has  some  amount  of  un¬ 
certainty  to  it.  Inferring  missing  links  and  nodes  in  the  network  is  one  of  the  key  problems  -  par¬ 
ticularly  when  studying  adversarial  and  covert  networks,  where  obfuscation  is  one  of  their  key 
protective  mechanisms.  Multiple  inference  mechanisms  exist. 
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Since  adversarial  networks  are  dynamic,  DNA  techniques  need  to  provide  for  ways  of  assess¬ 
ing  and  forecasting  change,  and  evaluating  the  impact  of  courses  of  action.  Given  the  likelihood 
of  missing  data,  DNA  techniques  need  to  be  robust  against  potentially  missing  data.  One  way  of 
increasing  robustness  is  to  focus  on  what  group  of  nodes  are  critical  as  opposed  to  focusing  on 
the  exact  rank  ordering.  Missing  links  can  be  inferred  and  then  DNA  techniques  can  be  used  to 
assess  the  impact  of  inferred  links  on  the  conclusions  drawn. 

We  now  present  a  few  examples  of  applications  illustrating  various  ways  adversarial  forces 
have  been  modeled  with  DNA  techniques. 

10.2  Predicting  important  changes:  the  organizational  restructuring  of  Al-Qaeda 

A  key  question  in  understanding  the  adversary  is  “when  did  they  change?”.  To  address  this 
question  change  detection  tools  for  networks  can  be  used.  In  this  case,  given  a  set  of  networks 
from  a  sequence  of  time  periods,  change  in  the  group  is  detected  by  identifying  shifts  in  trends 
for  key  network  metrics  such  as  betweenness. 

We  used  AutoMap  to  extract  a  sequence  of  networks  describing  the  connections  among 
members  of  al-Qaeda  from  open  source  documents.  A  set  of  networks,  one  per  year,  from  1994 
to  2004  were  extracted.  These  networks  were  then  examined  with  ORA  and  key  metrics  calcu¬ 
lated  including  closeness,  density,  average  betweenness,  and  the  clustering  coefficient.  This  data 
was  then  used  to  assess  change.  In  Fig.  1 0.1  the  Closeness  CUSUM  Statistic  for  this  data  is 
shown.  This  technique  showed  that  although  the  evident  signal  change  was  in  2001,  the  change 
began  in  1997. 


Fig.  10.1  The  closeness  CUSUM  statistic  graph  over  time  for  Al-Qaeda 

The  strength  of  this  technique  is  that  identifies  the  historical  change  point.  It  is  critical  to  note 
that  this  technique  is  for  assessing  historical  data.  It  is  not  a  predictive  technique.  Further,  it  is 
left  to  the  analyst  to  identify  what  factors  at  the  change  point  could  have  led  to  the  change.  In 
this  case  contributing  factors  may  have  been  that  bright  star  was  cut  short. 
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10.3  Assessing  Destabilization  From  a  Social  and  Task  Based  Perspective 

In  many  domains  where  situations  are  dynamically  changing,  ‘what-if  analysis  is  a  critical  ques¬ 
tion  to  prepare  for  the  future.  Some  disciplines,  such  as  intelligence,  corporate  management,  mil¬ 
itary  command  and  control,  etc,  have  various  threat  scenarios  and  organizations  wonder  what 
will  happen  if  the  scenarios  become  realized.  For  example,  from  the  perspective  of  destabiliza¬ 
tion  analysis,  an  interesting  question  is  what  will  happen  to  a  terrorist  organization  if  key  terror¬ 
ists  are  removed.  Destabilization  analysts  want  to  know  the  deterioration  of  the  adversarial  or¬ 
ganization’s  performance  and  the  organizational  structure  after  their  removal.  Doing  such  what-if 
analysis  is  a  way  of  evaluating  alternative  courses  of  action. 

The  ideal  methods  to  answer  these  questions  would  be  replicating  the  target  domains  and  the 
organizations  many  times  in  the  real  world  and  testing  the  scenarios  in  the  replicated  environ¬ 
ments.  The  organization  science  and  social  science  communities  approximate  the  above  experi¬ 
ments  through  field  studies  and  collection  of  experimental  data  in  labs.  However,  these  tech¬ 
niques  are  very  expensive,  and  can  potentially  transgress  into  unethical  or  immoral  areas.  Adver¬ 
sarial  organizations,  in  particular,  are  difficult  to  replicate  in  the  real  world.  Generally,  we  have 
limited  understanding  about  their  organizations  or  their  complex  collective  emergent  behavior 
arising  from  their  decentralized  structures. 

Overcoming  these  limitations  has  been  one  of  the  most  significant  benefits  of  using  Agent 
Based  Models  (ABM)  with  large  numbers  of  heterogeneous  agents.  The  nature  of  ABMs  have 
provided  a  nice  analogy  to  human  organizations  and  actors  which  has  allowed  policy  domains, 
such  as  civil  violence  [222],  the  transportation  of  goods  [223],  [224],  to  experiment  and  use 
ABMs.  For  example.  Bio-war  [225]  is  a  city  scale  ABM  for  examining  the  impact  of  various  in¬ 
terventions  in  mitigating  the  impact  of  weaponized  disease  attacks  or  pandemics.  Additionally, 
the  growth  of  computing  power  allows  the  researcher  or  policy  analyst  to  use  ABMs  to  run  mul¬ 
tiple  experiments  for  many  times  with  less  cost.  Researchers  interested  in  organizational  theory 
and  strategy  have  used  ABMs  to  build  and  develop  theories  of  organizational  learning  and  per¬ 
formance  [226],  [227],  [228]. 

Figure  10.2  reflects  the  generalized  approach  taken  by  researchers  conducting  Dynamic  Net¬ 
work  Analysis.  The  simulation  analysis  begins  by  selecting  a  target  organization  to  simulate  and 
proper  parameter  value  selections.  This  is  a  specification  applied  to  every  simulation.  In  contrast 
to  these  general  simulation  specifications,  a  researcher  can  apply  different  simulation  scenarios, 
i.e.  by  changing  who  to  remove  and  when  from  a  simulated  organization.  Each  of  these  different 
simulation  scenarios  forms  an  experiment  cell  in  a  virtual  experiment.  A  researcher  then  repli¬ 
cates  each  experiment  cell  with  a  coded  simulation  model.  After  the  replications,  the  simulation 
model  generates  1)  organizational  performance  and  general  statistics  and  2)  detailed  agent  beha¬ 
vior  records  over  the  course  of  simulations.  With  regression  analysis,  analysis  of  variance,  and 
simple  visualizations  the  researcher(s)  can  review  and  analyze  the  performance  values  and  log 
records.  Of  particular  note  is  the  ability  to  chain  experiments  together  as  simulation  generates  an 
estimated  organizational  structure(s)  and  element  distributions  at  the  end  of  the  simulation  run. 
The  estimated  organizational  structure(s)  can  be  fed  back  to  the  simulation  model,  and  the  simu¬ 
lation  analysis  cycle  can  start  again. 
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Fig.  10.2  An  overall  simulation  analysis  procedure 

In  the  remainder  of  this  section,  we’ll  review  ‘what-if  analyses  of  adversarial  organizations 
under  different  possible  intervention  scenarios.  The  analyses  are  done  by  using  a  version  of  Con¬ 
struct  modified  to  work  directly  from  ORA  using  networks  generated  by  the  user  and  outputting 
the  evolved  organizational  structure  of  the  group  being  simulated  and  its  performance  characte¬ 
ristics.  This  version  of  Construct  is  referred  to  as  JDyNet.  Next  we’ll  review  the  collected  struc¬ 
tural  datasets,  the  modeled  the  target  organizations’  agent  behavior,  such  as  task  performance, 
information  diffusion,  and  resource  passing.  Finally,  we’ll  review  the  created  hypotheses  with 
dynamic  network  analysis  from  the  viewpoint  of  terrorist  removals,  and  how  we  turned  the  hypo¬ 
theses  into  simulation  scenarios.  With  the  input  organizational  structure  dataset,  agent  behavior 
model,  and  simulation  scenarios,  we  gauge  the  impact  of  the  intervention  scenarios.  In  this  anal¬ 
ysis  we  use  of  the  Tanzania  and  Kenya  dataset  reflecting  publicly  available  information  about  the 
bombings  of  the  American  Embassies  which  have  been  coded  as  a  meta-network  connecting 
people,  resources,  expertise,  and  tasks. 

10.3.1  Simulation  Model  Description 

JDynet  is  the  simulation  model  designed  and  used  to  estimate  the  collective  behavior  of  adversa¬ 
ries  throughout  this  chapter.  JDynet  takes  a  number  of  inputs  which  reflect  an  adversarial  organi¬ 
zational  structure  and  parameters.  After  a  simulation  run,  JDynet  produces  an  expected  post¬ 
scenario  organizational  structure  and  various  over-time  organizational  performance  scores.  Dur¬ 
ing  the  simulation,  JDynet  calculates  its  internal  status  variables  repeatedly  and  simulate  the  time 
flow.  This  analysis  procedure  incorporates  inputs,  outputs  and  simulation  model  internal  va¬ 
riables.  Table  10.1  summarize  the  relevant  variables. 
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TABLE  10.1  This  table  contains  a  summary  the  input  and  output  variables,  and  the  associated 
parameters,  for  the  JDyNet  simulation  runs  with  associated  names  and  description. 


Type 

Name  (Default  value  in  the 
parenthesis) 

Implication 

Input 

A  networked  organizational 
structure  (a  meta-network) 

A  network  including  agents,  knowledge  bits,  tasks,  and  lo¬ 
cations.  The  network  represents  the  target  domain’s  com¬ 
plex  organizational  structure. 

Simulation  scenario 

A  sequence  of  agent  removal  specification.  An  element  of 
sequence  specifies  the  removal  target  agent  and  the  remov¬ 
al  timing. 

Output 

An  evolved  network  organi¬ 
zation  (a  meta-network) 

A  network  organization  with  a  recreated  agent-to-agent 
(AA)  network  and  an  agent-to-location  (AL)  network,  both 
of  which  reflect  organizational  element  transfers,  social 
interactions  and  geospatial  relocations. 

Diffusion 

A  performance  metric  showing  how  fast  information  can 
diffuse  across  the  network. 

Energy  task  accuracy 

A  performance  metric  showing  how  accurately  information 
is  distributed  to  agents  who  require  it  to  complete  their 
tasks. 

Binary  task  accuracy 

A  performance  metric  showing  how  accurately  agents  can 
classify  their  binarized  assigned  tasks  with  provided  infor¬ 
mation 

Task  completion 

A  performance  metric  displaying  what  percentage  of  the 
organization’s  tasks  are  completed 

Task  completion  speed 

A  performance  metric  displaying  how  quickly  each  of  tasks 
can  be  completed  on  average.  The  inverse  of  the  average 
task  completion  simulated  time-step 

Mission  completion  speed 

A  performance  metric  displaying  how  quickly  the  entire 
task  dependency  network  can  be  completed.  The  inverse  of 
the  mission  completion  simulated  time-step 

Gantt  chart 

An  estimated  mission  progress  displayed  in  the  Gantt  chart 
format 

Parameters 

Number  of  time-step  (5000) 

The  number  of  simulated  time-steps 

Number  of  replications  (30) 

The  number  of  replications  to  stabilize  the  outputs  of  this 
stochastic  simulation 

Weights  for  requested  ele¬ 
ment  delivery  (0.33),  others’ 
request  passing  (0.33),  or  the 
agent’s  request  passing  (0.33) 

Only  used  in  task  performance  agent  interaction  model. 
Weights  for  selecting  an  agent  interaction  purpose.  An 
agent  selects  one  purpose  out  of  three,  requested  organiza¬ 
tional  element  (expertise  or  resource)  delivery,  his  required 
element  request  to  others,  or  passing  others’  request  to  dif¬ 
ferent  others. 

Correct  binary  task  accuracy 
threshold  (0.5) 

When  calculating  binary  task  accuracy,  the  agents  have  to 
make  guesses  on  the  unknown  information.  This  number 
specifies  the  probability  of  the  correct  guess 
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Type 

Name  (Default  value  in  the 
parenthesis) 

Implication 

Interaction  count  for  time- 
step  (3) 

An  agent  cannot  interact  with  another  agent  after  this  max¬ 
imum  interaction  count. 

Cognitive  power  for  time-step 

(3) 

An  agent  can  only  respond  to  the  number  of  interactions 
specified  by  this  parameter. 

Exchange  success  rate  (0.75) 

If  an  agent  diffuses  information  or  passes  a  resource  to 
another  agent,  there  is  a  success  rate  of  such  trials. 

Interaction  social  distance 
radius  (1) 

Interaction  candidates  are  limited  to  agents  who  are  within 
N  social  link  radius  from  the  interaction  initiating  agent. 

Task  execution  success  rate 
(0.5) 

When  an  agent  performs  a  task,  the  agent  can  accomplish 
the  task  with  this  success  rate.  If  the  task  is  not  ready  (the 
ready  state  is  elaborated  later),  an  agent  cannot  perform  the 
task. 

Exchange  only  required  ele¬ 
ments  (true) 

If  this  is  true,  agents  only  exchange  expertise  or  resources 
only  the  receiving  agent  needs  such  elements. 

Treat  resource  as  information 
(false) 

If  this  is  true,  resources  are  duplicated  when  it  is  passed,  so 
that  the  sending  and  receiving  agents  have  the  passed  re¬ 
source. 

Take  over  removed  agent 
links  (true) 

If  this  is  true,  an  agent  recognizing  that  the  interacting 
agent  is  removed  can  take  over  the  target  agent’s  various 
links  to  organizational  elements,  other  agents  and  assigned 
tasks. 

Recognize  that  interaction 
partner  is  removed  (0.1) 

This  is  a  success  rate  that  an  agent  recognizes  the  interac¬ 
tion  target  agent  is  actually  removed. 

Recover  links  from  the  re¬ 
moved  agents  (0.3) 

After  an  agent  recognizes  another  agent  is  removed,  the 
agent  can  recover  the  links  between  the  agent  and  the  other 
agent  with  this  probability 

Request  decay  time  (7) 

After  this  number  of  simulated  time-steps,  the  organiza¬ 
tional  element  request  is  removed. 

Transactive  memory  decay 
time  (7) 

After  this  number  of  simulated  time-steps,  an  agent’s  trans¬ 
active  memory  about  other  agents  is  removed. 

Maximum  transactive  memo¬ 
ry  element  (30) 

This  is  the  maximum  number  of  transactive  memory  about 
other  agents’  links 

Subsequent  sections  introduce  and  explain  where  the  simulation  uses  these  inputs,  outputs 
and  parameters.  The  sections  will  also  discuss  the  values  selected,  and  interpretations  of  the  val¬ 
ues.  Researchers  design  virtual  experiments  by  varying  these  parameters  or  inputs  to  test  hypo¬ 
thesis  on  the  destabilization  of  a  target  organization.  A  human  analyst  1)  selects  the  most  appro¬ 
priate  parameter  values,  2)  strategizes  the  agent  removal  sequence  and  3)  runs  a  number  of  simu¬ 
lations  with  the  specifications.  After  the  runs,  the  analyst  drills  down  the  organizational  perfor¬ 
mance  degradation  and  correlates  the  impact  with  his  agent  removal  sequence. 
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Agent  social  behavior 

JDynet  agent  behavior  is  largely  in  two  parts:  social  interaction  and  task  performance.  An  agent 
initiates  social  interactions  to  receive  expertise  or  a  resource  from  the  interaction  partner  or  to 
send  a  request  for  expertise  or  resource  to  the  partner.  An  agent  also  executes  a  task  that  is  ready 
for  execution.  A  task  is  ready  for  execution  if  all  the  prerequisite  tasks  are  done,  and  if  the  group 
of  assigned  agents  has  at  least  one  required  resource  and  expertise.  More  detailed  descriptions 
are  in  the  following  sections.  Fig.  10.3  shows  the  high-level  agent  behavior  flow  during  the  si¬ 
mulations. 


Simulation 


Agent  Behavior 


Fig.  10.3  High  level  agent  behavior  logic 

Selecting  an  interaction  partner  agent 

The  model  of  agent  behavior  with  respect  to  tasks  draws  on  research  in  the  operations  research 
area  and  combines  this  with  the  socio-cognitive  agent  behavior  model  in  Construct  [8].  An  agent 
only  initiates  interactions  with  others  if  they  need  to  communicate  with  them  to  perform  his  as¬ 
signed  tasks.  They  may  seek  their  own  necessities,  pass  the  past  interaction  partner’s  request  for 
resource  or  expertise,  or  pass  the  acquired  resources  or  expertise  to  the  past  partner  who  needs 
them. 

Agents  in  this  model  select  an  agent  as  an  interaction  partner  if  he  can  give  a  necessity  to 
them.  If  there  is  no  agent  that  needs  an  organizational  element  (e.g.  a  resource,  knowledge),  the 
agents  choose  an  interaction  partner  randomly.  Additionally,  an  agent  can  pass  expertise,  a  per¬ 
sonal  resource,  as  well  as  an  element  request  that  he  or  a  past-interaction-partner  initiated.  This 
model  illustrates  how  the  agents  will  interact  when  they  are  goal-oriented.  While  the  sociological 
model  is  appropriate  for  simulating  the  belief  or  ideology  dispersion,  this  model  is  appropriate 
for  simulating  the  organizational  collective  behavior  to  complete  the  tasks  in  their  task  network. 
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This  task-completion  oriented  agent  interaction  is  modeled  as  three  different  agent  choice  moti¬ 
vations  below. 

1)  Choosing  a  motivation  for  interactions:  An  agent  chooses  one  interaction  motivation  out 
of  three  motivations:  requested  element  delivery,  others’  request  passing,  and  the  agent’s 
request  passing.  This  is  a  random  weighted  selection,  and  the  weights  are  specified  by  an 
analyst.  Weights  for  requested  element  delivery,  others  ’  request  passing,  and  the  agent ’s 
request  passing  in  Table  10.1.  After  the  choice  of  the  motivation,  the  agents  select  an 
agent  as  the  following  partner  choice  mechanisms. 

2)  The  agent’s  request  passing:  If  an  agent  chose  the  agent’s  request  passing  motivation,  the 
agent  finds  one  required-but-not-acquired  expertise  or  resource  to  perform  his  assigned 
tasks.  Then,  the  agent  searches  an  agent  who  has  the  required  organizational  element,  and 
he  initiates  an  interaction  with  the  searched  agent  to  receive  the  required  element.  If  there 
is  no  agent  with  the  required  element,  the  agent  interacts  with  a  randomly  chosen  agent 
and  leaves  a  request  for  element  delivery.  The  possible  interaction  partners  are  limited  as 
the  sociological  limit  the  interaction  candidate  set. 

3)  Others’  request  passing:  If  an  agent  chose  the  others’  request  passing  motivation,  the 
agent  finds  one  requested  element  among  the  requests  for  element  delivery  from  others. 
Rest  of  the  selection  procedure  is  identical  to  the  agent’s  request  passing  motivation.  The 
agent  searches  an  agent  who  has  the  requested  organizational  element,  and  he  initiates  an 
interaction  with  the  searched  agent  to  receive  the  required  element.  If  there  is  no  agent 
with  the  required  element,  the  agent  interacts  with  a  randomly  chosen  agent  and  leaves  a 
request  for  element  delivery.  The  possible  interaction  partners  are  limited  as  the  sociolog¬ 
ical  limit  the  interaction  candidate  set. 

4)  Requested  element  delivery.  If  an  agent  chose  the  requested  element  delivery  motivation, 
the  agent  will  find  an  agent  who  left  a  delivery  request  during  the  past  interactions.  The 
organizational  element  in  the  delivery  request  should  be  possessed  by  the  agent.  Then, 
the  agent  initiates  an  interaction  with  the  found  agent  to  send  the  organizational  element 
that  the  interaction  partner  requested  previously. 

Transfer  an  organizational  element  or  a  delivery  request 

The  effect  of  an  interaction  between  two  agents  is  either  resource  passing,  expertise  diffusion  or 
delivery  request.  There  are  also  two  ways  of  modeling  organizational  elements  transfer.  The 
original  Construct  model  did  not  differentiate  a  resource  from  expertise  from  the  perspective  of 
diffusion.  The  interaction  sender’s  resource  is  duplicated  and  put  in  both  sender’s  and  receiver’s 
possessions.  Therefore,  in  the  original  Construct,  interaction  results  in  the  diffusing  of  organiza¬ 
tional  elements,  not  the  passing  on  of  requests.  Here,  in  JDyNet  we  explore  how  to  extend  Con¬ 
struct  to  include  requests. 

On  the  other  hand,  this  suggested  model  provides  a  new  way  of  producing  interaction  out¬ 
comes.  First,  a  resource  is  not  duplicated  and  just  passed  from  the  sender  to  the  receiver.  Second, 
an  agent  can  leave  a  delivery  request  for  expertise  or  a  resource,  so  that  the  interaction  partner 
can  remember  that  the  initiating  agent  needs  such  elements.  Both  ways  of  transferring  an  organi¬ 
zational  element  allows  only  one  element  transfer  for  a  single  interaction.  If  the  simulation  has 
already  removed  the  agent  from  the  possible  interaction  list  (e.g.  the  agent  is  dead,  unavailable 
for  that  ‘turn’),  or  has  exceeded  the  number  of  interactions  specified  as  maximum  interaction 
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count  for  time-step  in  Table  10.1,  then  the  agent  cannot  transfer  any  of  expertise  or  resources. 
By  taking  these  diverse  forms  of  interaction  together  complex  sequences  of  actions  by  agents  can 
be  captured  as  is  illustrated  in  Fig.  10.4. 


Fig.  10.4  An  example  of  agent  behavior  during  the  simulation  from  the  Kenya  data.  The  dashed 
arrows  are  the  organizational  element  {surveillance  equipment)  requests  to  the  interaction  partner 
agents.  The  solid  arrows  are  the  actual  transfer  of  the  surveillance  equipment.  The  solid  line  po¬ 
lygon  includes  Wadih  el-Hage\  arrange  for  facilitation  and  delivery,  and  false  travel  documents. 
Wadih  el-Hage  can  perform  the  arrange  for  facilitation  and  delivery  task  because  he  has  the  re¬ 
quired  resource,  travel  documents. 

Take-over  the  removed  agent’s  expertise,  resource,  task  and  social  contacts 

If  an  agent  initiates  an  interaction  with  an  already-removed  agent,  the  interaction-initiating-agent 
may  recognize  that  the  partner  agent  is  not  present.  This  recognition  is  turned  on  if  an  analyst 
makes  Take-over  removed  agent  links  true.  The  recognition  also  depends  on  the  random  coin 
toss  whose  probability  is  specified  as  Recognize  that  the  interaction  partner  is  removed  in  Table 
10.1. 

After  the  coin  toss,  if  the  agent  is  allowed  to  take-over  the  removed  agent’s  neighbor  agents, 
resources,  expertise  and  tasks,  the  agent  creates  a  link  to  those  legacies.  However,  to  recover  the 
links  from  the  removed  agents,  the  recovering  agents  should  have  prior  knowledge  about  the  ex¬ 
istence  of  the  link.  This  is  modeled  from  the  transactive  memory.  Each  of  the  agents  has  transac¬ 
tive  memory  storing  the  perceived  link  information  of  other  agents.  After  the  link  recoveries,  he 
updates  the  agent-to-agent  network  space,  so  that  the  other  agents  wouldn’t  make  more  interac¬ 
tions  to  the  removed  agent.  Each  agent  can  communicate  transactive  information  in  addition,  or 
instead  of  information  that  they  directly  know.  The  movement  of  transactive  information  is 
shown  in  Fig.  10.5. 
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This  take-over  mechanism  simulates  the  resilience  of  an  adversarial  organization.  The  adver¬ 
saries  will  reassign  agents  to  resources,  expertise  and  tasks,  to  compensate  the  removed  agents. 

H  nl  1 -l! » 


detonate 


OHsh 


Transactive  memory 
transfer  over-time 
i.e.  (Khalfan  Fahid) 


Transactive  memory 
transfer  over-time 
i.e.  (Khalfan  ->  Fahid) 


Mohammed's  transactive  memory 


Source 


Source  Target 


Target 


purchase_vehicle 

acetylene 
oxygen 


Fahid  Mohammed  Ally  Msalam 


driving_expertise 

e  d  ucati  o  n_a  n  d_trai  ni  n  g 


Abdel  Rahman 


Khalfan  Khamis  Mohamed 


Abdel's  transactive  memory 


Khalfan  Purchase 

vehicle 

Khalfan  Detonate 

Mohammed  Driving 
expertise 

Khalfan  Fahid 


Khalfan 

Oxygen 

Khalfan 

Fahid 

Abdel 

Education 

and  training 

Abdel 

Mohammed 

Khalfan's  transactive  memory 


Mohammed 

Driving 

expertise 

Abdel 

Mohammed 

Education 
and  training 


Fig.  10.5  A  illustrative  example  of  transaetive  memory  transfer.  A  link  information,  sueh  as 

Khalfan  Khamis  Mohamed  is  linked  to  Fahid  Mohammed  Ally  Msalam,  ean  be  transferred 
through  the  interaetion  network  among  agents.  The  transferred  transaetive  memory  is  staeked  in 
the  reeeived  agent’s  transaetive  memory  repository.  After  transaetive  memory  deeay  time-steps, 
the  deeayed  transaetive  memory  element  is  removed. 

Perform  an  assigned  task 

An  agent  performs  a  task  if  the  task  is  ready  for  exeeution.  There  are  three  statuses  for  a  task  ae- 
eording  to  the  resouree  and  expertise  distribution  over  the  eourse  of  simulation. 

1)  Not  Ready:  A  task  is  not  ready  if  its  prerequisite  tasks  are  not  completed.  The  prerequisite  tasks 
are  defined  in  the  task  dependency  network  of  the  input  meta-network. 

2)  Ready:  A  task  is  ready  if  its  prerequisites  are  done.  However,  this  ready  status  does  not  guarantee 
the  task  completion.  The  group  of  assigned  agents  has  at  least  one  piece  of  each  required  element 
to  the  task,  but  the  group  may  not  be  fully  equipped  with  expertise  and  resources  to  perform  the 
task.  From  ready  status,  an  assigned  agent  can  perform  the  task  by  coin-tossing  with  Task  execu¬ 
tion  success  rate  probability.  If  the  required  resources  and  expertise  are  not  acquired  by  the 
group  of  assigned  agents,  the  task  performance  will  always  fail. 

3)  Done:  A  task  is  done  if  the  group  of  assigned  agents  has  the  required  expertise  and  resources,  at 
least  one  piece,  and  if  one  of  the  assigned  agents  performed  the  task  by  successfully  coin-tossing 
whose  probability  is  specified  in  Task  execution  success  rate. 
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10.3.2  Virtual  Experiment  Design 

Virtual  experiment  design  for  destabilization  analysis  consists  of  two  parts.  First,  an  analyst 
needs  to  specify  the  simulation  model  parameters,  such  as  the  number  of  simulation  time-steps, 
interaction  ways  (either  sociology-oriented  interaction  or  operations-research  oriented  interac¬ 
tion),  weights  for  interaction  methods,  etc.  Second,  an  analyst  needs  to  compose  a  simulation 
scenario:  who  to  remove  and  when.  Fundamentally,  an  analyst  can  determine  the  values  for  the 
parameters  specified  in  Table  10.1  with  his  qualitative  insights  into  a  target  organization. 

The  presented  virtual  experiment  in  this  section  varies  simulation  scenarios  in  three  ways:  re¬ 
moved  agent  selection  scheme;  number  of  removals;  and  removal  timings.  The  permutation  of 
these  three  factors  and  values  are  listed  in  Table  10.2.  There  are  sixty-four  (64)  different  virtual 
experiment  cells  that  each  have  a  different  simulation  environment.  For  instance,  the  experiment 
cells  with  larger  intervention  size  remove  more  terrorists  over  the  course  of  simulations.  The  ex¬ 
periment  cells  with  later  intervention  timing  removes  agents  in  the  relatively  late  phases  of  simu¬ 
lations.  Also,  the  experiment  cells  have  diverse  intervention  target  selection  schemes  according 
to  removal  target  selection  scheme.  This  is  the  manipulation  of  simulation  scenario.  Further  ana¬ 
lyses  can  be  done  by  changing  the  simulation  parameters,  but  such  experiments  are  not  done  in 
this  case.  Human  analysts  can  alter  a  virtual  experiment  by  altering  the  default  value  that  used  in 
this  report  and  listed  in  Tables  10.1  and  10.2 


TABLE  10.2  A  table  describing  the  design  of  a  virtual  experiment  assessing  the  impact  of  di¬ 
verse  courses  of  action  for  targeting  difference  adversaries.  For  each  cell  shown  there  would  be 

15  replications  and  2500  simulation  time  steps. 


Name 

Value 

Implication 

Removal  target 

selection 

scheme 

Degree,  Betweenness,  Eigen¬ 
vector  centralities  and  Cogni¬ 
tive  Demand  (4  cases) 

Agents  with  high  network  values  are  con¬ 
sidered  critical,  and  their  removal  is  critical 
to  the  organizations.  This  is  how  we  pick 
target  agents  to  remove. 

Intervention 

size 

1,  5,  9,  and  12  agent  removals 
(removing  10%,  30%,  50%  and 
70%  of  agents,  4  cases) 

The  intervention  size  specifies  how  many 
agents  to  remove  with  this  intervention. 

Intervention 

timing 

125,  250,  500,  and  1000  time- 
step  (removing  at  after  5%, 

10%,  20%  and  40%  timeflow, 

4  cases) 

The  intervention  happens  at  a  specific 
stage  of  simulation  period. 

Total  virtual 
experiment  cells 

64  cells 
(4x4x4  cases) 

The  following  dynamic  network  analysis  measures  decided  which  agents  to  remove  over  the 
course  of  simulations:  Degree,  Betweenness,  and  Eigenvector  centralities  and  Cognitive  De¬ 
mand.  Without  such  analysis,  a  human  analyst  would  need  some  other  heuristic  to  reduce  the 
quantity  of  possible  simulation  scenarios.  Interpretations  of  the  metrics  listed  above  are  in  Table 
10.3. 
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TABLE  10.3  Dynamic  network  metrics  used  to  determine  the  target  agents  to  remove 


Name 

Interpretation 

Reference 

Degree  Cen¬ 

trality 

Number  of  in-coming  and  out-going  links  from  a 
node.  Degree  of  direct  influence  to  others 

[229] 

Betweenness 

Centrality 

Number  of  shortest  paths  passing  a  node.  Degree  of 
information  flow  control 

[229] 

Eigenvector 

Centrality 

Calculates  the  eigenvector  of  the  largest  positive  ei¬ 
genvalue  of  the  adjacency  matrix,  Degree  of  connec¬ 
tions  to  the  high-scoring  nodes 

[230] 

Cognitive  De¬ 
mand 

Measures  the  total  amount  of  effort  expended  by  each 
agent  to  do  his/her  tasks,  calculation  details  are  elabo¬ 
rated  below. 

[231] 

Remove  an  agent  specified  in  the  intervention  sequence 

JDynet  helps  a  researcher  or  analyst  assess  the  impact  of  intervention  strategies,  or  an  agent  re¬ 
moval  sequence.  In  Table  10.1,  there  is  an  input,  Simulation  scenario.  Simulation  scenario  is  a 
sequence  of  agent  removal  specifications.  An  agent  removal  specification  displays  the  target 
agent  to  be  removed  and  when  the  target  will  be  removed  in  the  simulation  time. 

At  the  end  of  every  time-step,  JDynet  goes  through  the  agent  lists  and  finds  an  agent  that 
should  be  removed  at  the  time-step.  If  an  agent  is  removed,  then  the  agent  cannot  make  any  ac¬ 
tions,  either  social  interactions,  organizational  element  transfers,  or  task  performances. 


Performance  measures 

There  are  four  performance  metrics  to  assess  the  change  of  the  organization:  Diffusion;  Energy 
Task  Accuracy;  Binary  Task  Accuracy;  and  Task  Completion.  The  performance  metrics  support 
the  evaluation  of  performance  of  the  evolving  organization  over  time.  Evaluation  is  also  neces¬ 
sary  by  comparing  evolved  performance  values  to  those  of  a  non-intervention  case  (baseline). 
The  metrics  are  shown  below. 


1)  Diffusion:  Diffusion  measures  the  dispersion  of  expertise  and  resources  across  the 
agents. 


{Diffusion  )  = 


A  K 

I  Z  AKij 

i=0j=0 

KxA 


2)  Energy  Task  Accuracy:  Diffusion  only  considers  who  knows  or  has  what.  Whereas, 
energy  task  accuracy  calculates  the  extent  to  which  the  agents  have  the  knowledge 
they  need  to  do  the  tasks  they  are  assigned.  This  is  done  by  introducing  the  agent-to- 
task  (AT)  and  knowledge-to-task  (KT)  network  in  the  formula. 


f  (KTktx  iAKak) 

Ty'T’ A  ^  k  —  (}  U—O 

^ - 

ILATatx^KTkt 

a=0  k=0 
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3)  Binary  Task  Accuracy:  Binary  task  accuracy  measures  the  agents’  binarized,  assigned 
task  classification  capability  with  the  current  information  and  resource  availability.  A 
task  classification  is  performed  by  classifying  N  organizational  elements  required  to 
perform  the  task.  An  agent  always  classifies  an  organizational  element  correctly  if  he 
has  the  element.  If  the  agent  does  not  have  an  element,  he  can  guess  the  correct  an¬ 
swer  with  50%  of  chance.  Therefore,  if  an  agent  has  M  (<N)  required  elements,  then 
he  has  to  guess  (N-M)  elements  to  get  the  result  of  the  binarized  task.  The  task  per¬ 
formance  is  1  if  the  agent  classifies  more  than  50%  of  required  elements  correctly. 

4)  Task  Completion:  Task  completion  measures  the  number  of  completed  task  over  the 
course  of  the  previous  simulation  period.  A  task  is  completed  if  the  task’s  status  is  in 
done  status  as  explained  in  the  previous  section.  Task  completion  is  a  simple  ratio 
calculated  from 

(number  of  completed  tasks)  / 

(number  of  tasks  in  the  organizational  structure)  ’ 

5)  Task  Completion  Speed:  A  task  duration  is  the  simulated  time  length  between  the 
task’s  ready  status  to  done  status.  Then,  each  task’s  speed  is  determined  by  inversing 
the  task  duration.  I  average  each  of  the  task  speeds  and  calculate  the  organization  lev¬ 
el  task  completion  speed. 

6)  Mission  Completion  Speed:  Mission  completion  speed  is  the  inverse  of  the  number  of 
simulation  time-steps  over  the  course  of  the  task  dependency  network  completion. 
The  task  dependency  network  completion  means  the  entire  task  network  completion 
by  completing  individual  tasks  one  by  one. 

10.3.3  Results 

We  ran  the  above  virtual  experiments  with  the  Tanzania  and  Kenya  embassy  bombing  case.  The 
first  sub-section  examines  the  agent  removal  impacts  toward  organizational  performances.  The 
second  sub-section  examines  the  delayed  task  completion  timing  caused  by  the  agent  removals. 
The  third  sub-section  enumerated  the  key  individuals  over  the  course  of  simulations.  The  last 
section  of  the  results  are  the  visualization  the  agents’  collective  behavior  during  the  simulations. 

Impact  to  performance  measures 

After  running  four  different  simulation  scenarios  for  each  of  64  virtual  experiment  cells,  we  get 
64  simulation  results.  Table  10.4  shows  the  regression  on  the  simulation  settings  to  the  organiza¬ 
tional  performance  metrics.  This  regression  is  done  by  using  the  two  continuous  virtual  experi¬ 
ment  factors  (timing  and  size)  and  one  factor  (removal  selection  scheme)  with  four  categories. 
There  are  four  categories  in  the  removed  agent  selection  metrics.  The  four  categories’  representa¬ 
tion  is  through  assigning  1  if  the  simulation  used  the  metric,  and  0  if  it  did  not.  According  to  the 
regression  result,  earlier  interventions  (smaller  intervention  timing  value)  and  larger  interven¬ 
tions  (larger  interventions  size)  are  preferable  in  reducing  the  performance.  In  terms  of  the  re¬ 
moval  target  selection,  removing  top  Degree  Centrality  terrorists  can  reduce  the  mission  execu¬ 
tion  speed,  the  task  execution  speed,  the  binary  task  accuracy  and  the  level  of  diffusion.  Similar 
trends  are  seen  in  the  case  of  removing  top  Eigenvector  Centrality  terrorists. 
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TABLE  10.4  A  table  showing  the  standardized  coefficients  for  regression  to  the  six  organiza¬ 
tional  performance  metrics  at  the  end  time  using  the  virtual  experiment  settings  (treating  re¬ 
moved  agent  selection  scheme  with  four  categorical  values)  (N=64  cases)  (*  for  P<0.05) 


Standardized 

Coefficient 

Mission 

Speed 

Task 

Speed 

BTA 

ETA 

Diffusion 

Task  Com¬ 
pletion 

Intervention 

Timing 

0.143* 

0.205 

-0.021 

0.081* 

-0.070* 

0.369* 

Intervention 

Size 

-0.808* 

-0.063 

-0.263* 

-0.978* 

0.977* 

-0.817* 

Degree  Cent. 

-0.013 

-0.192 

-0.121 

0.044 

-0.043 

0.033 

Betweenness 

Cent. 

0.195 

0.074 

-0.166 

0.041 

-0.042 

0.132 

Eigenvector 

Cent. 

0.014 

-0.096 

-0.312* 

0.018 

-0.014 

-0.003 

Cognitive  De¬ 
mand 

0.000 

0.000 

0.000 

0.000 

0.000 

0.000 

Adjusted  R- 
Square 

0.679 

0.005 

0.046 

0.958 

0.954 

0.797 

Table  10.5  shows  another  regression  analysis  used  to  investigate  the  characteristics  of  re¬ 
moved  agents.  For  this  regression,  researchers  compiled  the  average  network  metrics  of  removed 
agents  and  virtual  experiment  settings.  Again,  the  intervention  size  has  significant  influence  over 
the  mission  speed,  energy  task  accuracy,  diffusion  and  task  completion.  If  the  intervention  size 
gets  larger,  the  above  metrics  get  smaller.  The  intervention  timing  affects  somewhat  influence 
over  mission  speed,  binary  task  accuracy  and  task  completion.  If  the  intervention  timing  gets  ear¬ 
lier,  the  damage  gets  larger  (and  actual  performance  values  decrease).  The  regression  indicates 
that  Eigenvector  centrality  has  higher  influence  and  important  metrics  in  predicting  the  simulated 
organizational  performance.  For  example,  if  we  choose  to  remove  low  Eigenvector  centrality 
agents,  we  can  lower  the  mission  execution  speed,  task  execution  speed,  binary  task  accuracy, 
energy  task  accuracy,  and  task  completion.  If  we  choose  to  remove  high  Degree  centrality 
agents,  we  can  reduce  the  mission  execution  speed,  task  execution  speed,  binary  task  accuracy, 
energy  task  accuracy  and  task  completion  levels. 

One  thing  should  be  noticed  is  the  high  R-square  values.  In  typical  cases,  agent  based  social 
models  do  not  produce  high  R-square  values  because  inherent  randomness  and  complex  agent 
behavioral  models.  In  contrast,  the  presented  operations  research  based  model  shows  high  R 
square  values  in  the  linear  model. 

While  this  is  an  overall  result  of  the  64  different  virtual  experiment  settings,  we  present  the 
results  grouped  by  their  first  factors:  target  selection  scheme,  intervention  size,  and  intervention 
timing.  Fig.  10.5  is  the  over-time  organizational  performance  evolution  of  the  virtual  experiment 
cell  by  the  first  factors. 
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TABLE  10.5  A  table  showing  the  standardized  coefficients  for  regression  to  the  six  organiza¬ 
tional  performance  metrics  at  the  end  time  using  the  calculated  metrics  of  removed  agents  (N=64 

cases)  (*  for  P<0.05) 


Standardized 

Coefficient 

Mission 

Speed 

Task 

Speed 

BTA 

ETA 

Diffusion 

Task  Com¬ 
pletion 

Intervention 

Timing 

0.143* 

0.205 

-0.021 

0.081* 

-0.070* 

0.369* 

Intervention 

Size 

-2.198* 

-0.121 

-0.857 

-0.806* 

0.845* 

-1.555* 

Degree  Cent. 

-0.251 

-0.985 

-2.197* 

-0.473* 

0.542* 

-0.614 

Betweenness 

Cent. 

0.137 

-0.146 

0.465 

-0.151* 

0.142* 

0.050 

Eigenvector 

Cent. 

1.043* 

1.389 

2.587* 

0.551* 

-0.645* 

1.104* 

Cognitive  De¬ 
mand 

0.608* 

-0.319 

-0.441 

-0.184* 

0.181* 

0.219 

Adjusted  R- 
Square 

0.814 

-0.018 

0.102 

0.984 

0.982 

0.851 

Binary  task  accuracy  converges  to  the  evolved  state  quickly  because  I  used  the  modified  ver¬ 
sion  of  binary  task  accuracy  by  averaging  the  values  from  the  start  time  up  to  the  measure  calcu¬ 
lation  time.  The  energy  task  accuracy  and  diffusion  charts  exhibit  big  drops  at  the  intervention 
timing:  125,  250,  500  and  1000.  On  the  other  hand,  the  task  completion  chart  shows  gradual 
damages  over  the  course  of  simulations.  If  an  agent  is  removed  while  the  agent  is  not  needed 
right  now  to  execute  current  tasks,  then  the  agent’s  removal  does  not  decrease  the  performance 
right  away.  When  the  agent  is  needed,  the  baseline  case  can  perform  without  serious  problems, 
but  the  removal  cases  are  damaged  when  the  time  comes.  In  terms  of  Energy  Task  Accuracy, 
large  intervention  leaves  constant  and  permanent  damages  while  early  intervention  leaves  such 
damages  from  the  task  completion  perspective. 
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Fig.  10.5  Organizational  performance  over  time,  aggregated  by  the  first  factor 
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Impact  to  task  completion  timing 

The  output  from  simulations  can  then  be  assesses  with  standard  statistical  tools  or  network  ana¬ 
lytic  tools  like  ORA.  Using  the  JDynet  of  Construct  task  completion  behavior  can  be  examined. 
JDynet  regenerates  the  task  completion  status  over  the  simulation  period,  and  it  generates  a  task 
completion  speed,  a  mission  completion  speed  and  a  Gantt  chart.  Task  completion  timing  was 
one  of  the  areas  of  investigation. 
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Fig.  10.6  Percentage  of  Task  completion  speed  to  the  baseline,  64  virtual  experiment  cells 

Figure  10.6  shows  the  task  completion  speeds  of  the  64  virtual  experiment  cells.  The  chart 
value  is  the  percentage  value  of  a  specific  virtual  experiment  cell  compared  to  the  baseline  case. 
Therefore,  if  the  value  is  higher  than  100,  it  means  the  virtual  experiment  cell  has  faster  task 
completion  speed.  If  the  intervention  timing  is  late,  the  task  completion  speed  is  higher.  On  the 
other  hand,  if  the  intervention  happens  earlier,  some  tasks  are  impossible  to  be  executed  which 
makes  their  task  completion  speed  0. 

Figure  10.6  shows  that  removing  the  high  degree  centrality  agents  is  better  in  reducing  the 
task  completion  speed.  In  most  of  the  cases,  the  degree  centrality  based  removal  shows  below 
32%  of  the  task  completion  speed  compared  to  the  base  line  (except  four  cases  that  show 
101.38%,  97.92%,  99.56%,  104.88%).  In  general,  removing  a  small  number  of  agents  late  in  the 
simulation  does  not  cause  any  impact  or  damage  though  it  sometimes  increased  the  task  execu¬ 
tion  speed. 

Figure.  10.7  shows  the  mission  completion  speeds  of  the  64  virtual  experiment  cells.  Since 
some  removals  disabled  the  organization’s  ability  to  execute  their  entire  task  dependency  net¬ 
work,  the  cells  with  successful  mission  prevention  show  0  mission  completion  speed  (infinite 
execution  time).  These  complete  mission  disables  frequently  happen  when  removing  more  than 
30%  of  agents  at  the  earlier  stage.  If  the  interventions  are  not  successful,  some  cells  show  in- 
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creased  mission  execution  speed  (i.e.  103.55%  of  top  cognitive  demand  agent  10%  removal  at 
early  stage).  Again,  large  and  early  removals  show  better  destabilization  effect  compared  to  the 
small  and  late  removals. 
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Fig.  10.7  Percentage  of  Mission  completion  speed  to  the  baseline,  64  virtual  experiment 

cells 


Figure  10.8  shows  the  estimated  Gantt  chart  of  the  baseline  to  show  the  bottleneck  tasks  and 
the  task  durations.  This  demonstrates  the  JDynet  capability  to  generate  a  chart  organizations  and 
people  frequently  use  in  the  real  world.  This  helps  identify  which  task(s)  are  bottleneck  tasks  that 
slow  the  mission  execution  speed.  The  rent  residence  task  seems  to  have  the  longest  execution 
time  and  seriously  damages  the  mission  execution  speed.  The  rent  residence  is  the  prerequisite 
task  to  performing  the  run  bomb  factory  task  which  leads  the  later  task  chains.  Because  of  the 
rent  residence  task’s  delay,  other  tasks  executed  in  the  later  phases  got  held  up. 
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Fig.  10.8  The  estimated  Gantt  chart  of  the  baseline  case 

Agent  interactions  during  simulations 

The  simulation  allows  an  analyst  or  researcher  to  observe  the  agent  interactions  and  organiza¬ 
tional  element  transfers  over  the  course  of  the  simulation.  Figure  10.8  is  the  Gantt  chart  of  the 
baseline  case  over  the  course  of  the  mission  execution.  As  the  Gantt  chart  displays,  the  agents 
focus  on  different  tasks  as  the  mission  progresses.  Moreover,  the  agents  are  assigned  different 
tasks,  which  makes  their  interactions  and  organizational  element  transfers  change  over  time.  Fig. 
10.9  is  the  collection  of  the  agent  interactions  and  organizational  element  transfer  networks  dur¬ 
ing  the  course  of  the  simulation. 

The  agent  interaction  networks  show  no  significant  differences  over  time.  There  are  minimal 
changes  in  the  link  weights.  However,  the  agent  organizational  element  transfer  network  changes 
dramatically,  which  means  that  the  actual  usefulness  of  the  interactions  change  according  to 
whether  the  interaction  accompanies  an  organizational  element  transfer  or  not.  The  terrorists  are 
bounded  to  their  cellular  network  structure,  so  that  the  interaction  network  itself  is  not  an  ob¬ 
vious  change.  We  need  to  see  the  implied  the  usefulness  of  the  interactions  by  looking  into 
whether  the  link  was  used  to  actual  resources  or  expertise  transfer.  In  the  transfer  networks,  there 
are  isolated  agents  who  are  not  used  during  the  particular  time  period.  In  this  case,  a  manger  may 
consider  reassigning  the  agents  to  other  tasks  which  can  be  executed  in  parallel.  Also,  a  com¬ 
mander  may  consider  removing  heavily  used  agents  at  a  particular  time-step  when  they  can  fig¬ 
ure  out  which  transfer  network  is  going  on  at  the  intervention  timing.  Empirically,  Fazul  Abdul¬ 
lah  Mohammed,  Al  Owali  and  Wadih  el-Hage  are  the  agents  that  consistently  appear  in  the  trans¬ 
fer  network,  which  means  that  their  removals  would  be  effective  in  any  of  time  periods. 
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10.4.  Assessing  the  Impact  of  Destabilization  on  Adversarial  Movement 

One  of  the  key  problems  in  reasoning  about  adversarial  behavior  is  that  they  move.  Adversaries 
move  from  location  to  location  as  they  plan  and  take  action.  ABMs  tend  to  focus  on  either  spa¬ 
tial  movement  through  unrealistic  grids  or  they  ignore  space  entirely.  Although  the  social  pat¬ 
terns  of  adversary  groups  are  useful  for  identifying  them,  the  transnational  movement  patterns  of 
adversaries  can  be  an  even  clearer  indicator  [232],  [171],  [233].  A  model  that  predicts  important 
adversarial  movement  trends  would  be  powerful  and  useful. 

The  previous  example  introduced  a  model  for  simulating  adversaries’  social  behavior.  This  ex¬ 
ample  extends  the  model  by  adding  adversaries’  geospatial  behavior.  The  principal  addition  is  to 
extend  the  operations  research  based  social  behavior  modeled  in  the  previous  example  with 
movement  behavior.  Agents  relocate  in  order  to  complete  tasks,  and  spatial-proximity  influences 
link  maintenance.  If  an  agent  is  removed,  and  any  neighbors  are  present,  those  neighbors  are 
able  to  recover  the  agent’s  links.  Finally,  locations  contain  both  resources  and  information,  some 
of  which  may  not  be  available  to  the  organization  at  large.  Agents  may  travel  to  maximize  the 
resources  available  to  their  organization.  Herein  we  explore  how  to  adapt  Construct  so  as  to  en¬ 
able  the  adversaries  to  move  from  location  to  location,  and  in  doing  so  expand  the  set  of  interac¬ 
tion  logics  to  account  for  proximity  driven  interaction.  By  including  space  a  number  of  factors 
are  changed: 

1)  Simulation  model  iteration  management 

2)  Social  interaction  logics 

3)  Knowledge  of  space 

4)  Task  execution  logics 

This  section  describes  the  implementation  of  a  spatial  version  of  Construct,  a  virtual  experiment 
exploring  aspects  of  adversarial  movement,  and  the  results  of  that  experiment. 

We  apply  this  extended  model  to  the  1998  U.S.  Embassy  bombing  incidents  in  Kenya  and  Tan¬ 
zania.  Over  the  course  of  the  incident,  the  terrorists  have  to  extensively  move  around  regions  and 
cross  the  borders  to  align  the  resources  and  expertise  for  the  execution. 

In  this  extension,  an  agent  must  select  an  interaction  partner  agent  as  well  as  a  relocation  destina¬ 
tion.  Therefore,  as  the  agent  chooses  an  interaction  partner  in  the  previous  model,  the  agent 
chooses  a  place  to  move  in  this  model  (a  hi-level  behavior  flowchart  can  be  seen  in  Fig.  10.10. 
Agents  have  four  different  intentions  for  the  relocation,  these  intentions  range  from:  task  perfor¬ 
mance,  resource  acquisition,  interaction  facilitation,  and  edge  recovery  (network  robustness). 
The  details  on  how  these  intentions  impact  behavior  and  the  way  in  which  we  have  extended 
Construct  are  now  described. 
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Agent  to  Agent  network:  Interac¬ 
tion 


Agent  to  Agent  network 
Transfer  resources  and  expertise 


Fig.  10.9  Collection  of  agent  interaction  and  organizational  transfer  network  over  time,  link 
thickness  is  adjusted  to  show  the  frequency  of  the  link  usage. 
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Process 


Agent  Behavior 


Fig.  10.10  Agent  behavior  logie.  Compared  to  the  previous  behavior  model,  the  geospatial  relo- 
eation  and  the  regional  resouree/expertise  aequisitions  are  added. 

10.4.1  Simulation  model  iteration  management 

Simulation  iteration  is  the  main  loop  of  the  entire  model.  When  a  user  requests  a  simulation  run, 
the  simulation  will  exeeute  this  loop  after  loading  the  simulation  model  inputs  and  parameters. 
The  simulation  model  runs  a  number  of  iterations  to  simulate  the  passage  of  time.  These  itera¬ 
tions  are  eontrolled  by  a  loop  eontrolling  individual  agent  behavior.  Table  10.6  eontains  the 
pseudo  eode  for  this  outer  or  main  loop. 

TABLE  10.6  Geospatial  simulation  model  main  loop 

Function  main() 

Load  simulation  inputs; 

Setup  simulation  inputs; 

Setup  random; 

For  i  =  0  to  num_timestep 

simulation_iteration(random,i) ; 

Generate  and  output  intermediate  outputs  //as  directed  by  user  configuration 
End; 

Calculate_performance_value_for_entire_simulation(); 

Generatesimulationoutputs ; 

_ End  function; _ 
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As  depicted  in  the  above  pseudo  code,  the  model  rans  the  number  of  simulated  time-steps 
with  a  random  factor.  This  random  factor  makes  this  simulation  stochastic.  The  reason  behind 
this  randomness  is  explained  in  the  simulated  agent  behavior,  when  the  agent  must  use  this  ran¬ 
dom  factor  to  seed  their  coin-tosses. 

After  the  simulation  loop  finishes,  the  program  generates  the  performance  outputs.  There  are 
two  different  types  of  outputs  from  this  simulation  model.  First,  we  get  the  performance  num¬ 
bers,  i.e.  task  completion  rate,  knowledge  diffusion,  task  accuracy,  etc.  These  numbers  are 
printed  out  into  files  right  away.  The  second  output  type  is  the  estimated  network  outputs.  These 
outputs  are  recorded  in  a  DynetML  file,  so  that  the  file  can  be  loaded  in  ORA  and  visualize  the 
over-time  changes.  Thus,  Generate_simulation_output  should  handle  these  two  types  of  outputs. 

After  coding  this  big  loop  wrapping  the  entire  model,  we  code  the  individual  iteration  function 
that  will  be  invoked  over  time.  This  simulation_iteration  function  is  shown  in  Table  10.7. 

TABLE  10.7  Geospatial  simulation  iteration  for  each  time-step 

Function  simulation  iterationfRandom  r,  int  timestep) 

Agent  behavior  order  =  Randomized  orderfl  to  num  agent); 

While(Agent_behavior_order) 
i  =  next(Agent_behavior_order); 

Execute_agent_behavior(i,  r); 

End; 

Calculate_performance_value_for_timestep(); 

_ End  function; _ 


By  randomizing  the  agent  behavior  order,  we  can  simulate  the  randomness  in  the  action  fre¬ 
quency.  Also,  by  executing  every  agent’s  behavior  for  a  single  time-step,  we  can  guarantee  that 
the  agents  will  execute  their  actions  for  the  number  of  time-steps  throughout  the  simulation. 

The  simulation’s  main  loop  calls  the  simulation  iteration  function  for  the  user-specified  number 
of  time-steps.  The  simulation  iteration  function  calls  the  individual  agent  behavior  functions  in  a 
randomized  order.  The  below  is  the  specification  of  the  individual  agent  behavior  function.  As 
discussed  earlier,  the  agents  gather  knowledge  and  resources  and  perform  assigned  tasks  by  us¬ 
ing  gathered  elements.  Table  10.8  shows  the  agent  behavior  at  a  high  level. 

TABLE  10.8  High  level  agent  behavior 

Function  Execute_agent_behavior(int  agentID,  Random  r) 

Social_interaction(agentID,  r); 

Perform_task(agentID,  r); 

_ End  function; _ 


10.4.2  Social  interaction  logic  description 

The  following  pseudo  code  is  the  social  interaction  behavior  pattern  in  the  simulation.  There  are 
three  social  interaction  motivations  as  discussed  earlier  in  this  chapter.  The  three  motivations  are 
1)  requested  element  (knowledge  or  resource)  delivery;  2)  other’s  element  delivery  request  pass¬ 
ing;  and  3)  the  agent’s  element  delivery  request  generation  and  passing.  When  an  agent  has  a 
chance  to  make  a  social  interaction,  the  agent  makes  a  weighted  random  choice  to  select  one  mo¬ 
tivation  out  of  three.  This  weighted  random  choice  represents  the  gap  between  the  agent’s  inten¬ 
tion  and  action.  For  instance,  having  a  higher  probability  for  the  agent’s  element  request  genera¬ 
tion  is  a  representation  of  the  agent’s  intention  to  get  that  element.  However,  in  the  simulation, 
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he  might  have  to  pass  other’s  element  request  because  of  the  randomness.  Then,  his  action  is  dif¬ 
ferent  from  his  intention.  Having  said  this,  if  he  has  a  far  higher  probability  for  a  certain  motiva¬ 
tion,  then  he  is  very  likely  to  select  the  motivation  out  of  the  random  choice.  This  reflects  the 
strength  of  intention  and  increasing  likelihood  of  his  intention  realization.  Table  10.9  describes 
this  social  interaction  and  the  role  of  neighborhood  and  proximity  is  detailed. 

TABLE  10.9  Agent’s  social  interaction  implementation  pseudo  code 

Function  Social_interaction(int  agentID,  Random  r) 

Neighbor  agents  =  getSphereOf[nfluence(agentID,  one  social  link  away,  retum  only  agent); 
choice  =  weightedRandomChoice(r,  weight  element  delivery,  weight  others_request_passing, 
weightmyrequestgeneration); 

switch(choice) 

case  Element  delivery: 

Element  e  =  fmd_requested_and_possessing_element(agentID’s  elements); 

Request  req  =  find_request_records_specified_by_element(agentID’s  received  delivery  request,  e); 

If  ( req. sender  has  done  his  interaction  for  this  turn)  finish  this  block; 

If  ( req.sender  and  agentID  are  at  the  same  location ) 

If  ( transferSuccessProbAtSameLocation  <  r.nextValue  ) 

Unlink(agentID,e); 

Link(req.sender,e); 

End; 

Else 

If  ( transferSuccessProbAtDifferentLocation  <  r.nextValue  ) 

Unlink(agentID,e); 

Link(req.sender,e); 

End; 

End; 

Remove_request_records(req); 

Case  Others_request_passing: 

Request  req  =  fmd_request_records(agentID’s  received  delivery  request); 
interactionPartnerlD  =  pickoneagentwiththeelement 

_based_on_the_transactive_memory(agentID,  Neighboragents); 

If  ( interactionPartnerlD  has  done  his  interaction  for  this  turn)  finish  this  block; 

Request  newReq  =  new  Request(req.element,  agentID); 

Put_in_the_requestlist(interactionPartnerID,newReq); 

Case  My  request  generation: 

Element  e  =  fmd_required_element_not_in_possession(agentID);  Request  req  =  new  Request(e,  null); 

Put_in_the_request_list(agentID,req); 

End  switch; 

transactiveMemoryExchangePartnerlD  =  pick_one_agent_randonily(Neighbor_agents); 
exchangeTransactionMemory(agentID,  transactiveMemoryExchangePartnerlD); 

_ End  function; _ 


10.4.3  Knowledge  of  space 

At  the  end  of  the  social  interaction,  the  agent  exchanges  his  transactive  memory  with  a  randomly 
selected  neighboring  agent.  This  is  a  simulation  of  interactions  passing  the  information  about  the 
current  simulated  situation.  The  transactive  memory  element  exchanges  are  done  as  the  follow¬ 
ing  pseudo  code.  This  exchanged  transactive  memory  becomes  the  basis  for  agent  social  beha¬ 
vior:  finding  required  elements,  finding  interaction  partners,  etc.  The  key,  as  can  be  seen  in  Ta¬ 
ble  10.10  is  that  agents  who  are  not  proximal  are  not  finding  each  other  as  interaction  partners 
and  interacting.  Future  work  would  refine  this  by  allowing  for  different  types  of  communication 
some  of  which  is  proximity  based. 
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TABLE  10.10  Agent’s  transactive  management  pseudo  code 

Function  exchangeTransactiveMeniory(int  agent  1  ID,  int  agent2ID) 

Agent I  Neighbor  nodes  =  getSphereOf[nfluence(agentl,  one  social  link  away); 

Agent2_Neighbor_nodes  =  getSphereOfInfluence(agent2,  one  social  link  away); 

N  =  (number  of  transactive  memory  elements  exchanged); 

For  i  =  1  to  N 

Agent  Ineighbornode  =  randomly_pick_one_node(Agentl_Neighbor_nodes); 
Put_transactive_memory_tuple(  agent2ID, 

new  TransactiveMemoryElement(agentlID,  Agent  I  neighbor  node)); 

End; 

For  i  =  1  to  N 

Agent2_neighbor_node  =  randomly_pick_one_node(Agent2_Neighbor_nodes); 
Put_transactive_memory  tuple(  agent  1  ID, 

new  TransactiveMemoryElement(agent2ID,  Agent2_neighbor_node)); 

End; 

End  function; _ 


10.4.4  Task  execution  logics 

Finally,  the  agents  perform  task  execution  behavior.  A  task  is  not  ready  to  be  executed  if  the 
task’s  prerequisite  tasks  are  not  done  yet.  A  task  is  ready  to  be  executed  if  the  task’s  prerequisite 
tasks  are  done.  A  task  is  done  if  the  group  of  assigned  agents  has  all  the  required  resources, 
knowledge  and  is  placed  at  required  locations.  This  task  execution  model  is  described  in  Table 
10.11. 


TABLE  10.11  Agent’s  task  execution  implementation  pseudo  code 

Function  Perform_task(int  agentID,  Random  r) 
task  list  =  getSphereOfInfluence(agentID,  one  social  link  away,  only  task  nodes); 
readytasklist  =  selectonlyreadytask  (tasklist); 
tasktoexecute  =  randomly_pick_one_task_that_all_required 
_elemets_are_gathered(ready_task); 

If  ( taskExecutionSuccessRate  <  r.nextValue ) 
recordTaskIsDone(task_to_execute); 

End; 

End  function; _ 


10.4.5  Link  to  the  previous  description 

Figure  10.11  shows  which  simulation  flowchart  components  correspond  to  which  pseudo  codes 
in  the  previous  sections.  The  simulation  process  is  managed  by  the  simulation  model  main  loop. 
Table  10.6,  and  the  simulation  iteration  function.  Table  10.7.  In  the  simulation  iteration  func¬ 
tion,  each  agent  is  called  in  the  randomized  order,  and  the  agent  executes  three  aggregated  beha¬ 
vior  patterns.  The  first  behavior  pattern  is  the  social  interaction  that  is  implemented  as  Agent’s 
social  interaction  implementation  pseudo  code  in  Table  10.9.  Then,  the  second  pattern  is  the  task 
execution  implemented  as  Agent’s  task  execution  implementation  pseudo  code. 
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Fig.  10.1 1  Annotated  simulation  procedure  flow  chart.  The  annotation  specifies  which  items  in 

the  flow  chart  correspond  to  the  pseudo  code. 


Table  10.12  contains  a  list  of  key  parameters  and  how  these  parameters  are  utilized  by  the 
pseudo-code  (Tables  10.6  through  10.11).  These  parameters  were  introduced  earlier.  However, 
the  earlier  introductions  were  about  their  types  and  implications.  Table  10.13  provides  the  links 
between  the  pseudo  code  functions  and  the  used  parameters.  As  such,  it  provides  information 
about  where  the  user  parameters  are  used  in  which  part  of  the  simulation  model. 

10.4.6  Virtual  Experiment  Design 

The  experimental  design  used  here  is  similar  to  that  of  the  previous  example.  The  geo-analysis 
virtual  experiment  is  described  in  Table  10.13.  The  control  variables  are: 

a)  How  targets  are  selected 

b)  The  number  of  targets  removed  (size  of  intervention) 

c)  The  timing  of  the  removals  (intervention  timing) 

Targets  are  selected  based  on  one  of  four  factors,  each  of  which  is  a  measure  of  node  centrality. 
These  four  factors  are:  a)  degree  (number  of  connections  an  agent  has),  b)  betweeness  (the  num¬ 
ber  of  shortest  paths  that  run  through  this  agent),  c)  eigenvector  centrality  (how  connected  is  this 
agent  to  well-connected  agents),  and  d)  cognitive  demand  (multi-mode  measure  considering  an 
agent’s  connection  to  resources,  skills,  as  well  as  other  agents).  The  size  of  the  intervention  is 
another  factor  in  the  experimental  design  -  top  ranked  agents  up  to  the  number  required  are  re¬ 
moved  (so,  in  the  largest  case,  the  top  twelve  agents  for  the  given  selection  scheme  are  re- 
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moved).  When  the  interventions  take  place  is  another  factor,  the  interventions  occur  from  5  to 
40%  of  the  way  through  the  simulation’s  time-course. 


TABLE  10.12  A  table  describing  the  key  parameters  in  the  simulation  and  the  implication  of 

setting  these  parameters 


Name  (Default  value 
in  the  parenthesis) 

Which  pseudo  code 
function  uses  the  pa¬ 
rameter 

Implication 

Boost  for  interaction  if 
two  agents  are  co¬ 
located  (1.5) 

Social  interaction, 
(Table  10.9) 

If  two  interacting  agents  are  co-located,  the 
agents  will  have  higher  chances  of  transfer 
success. 

Boost  for  removal  rec¬ 
ognition  if  two  agents 
are  co-located  (1.5) 

Social  interaction 
(Table  10.9) 

If  an  agent  tries  to  recognize  one  removed 
agent  at  the  same  location,  the  agent  will 
have  higher  chance  in  recognizing  the  re¬ 
moved  agent. 

Number  of  time-step 
(5000) 

Main 

(Table  10.6) 

The  number  of  simulated  time-steps 

Weights  for  requested 
element  delivery  (0.33), 
others’  request  passing 
(0.33),  or  the  agent’s  re¬ 
quest  passing  (0.33) 

Social  interaction 
(Table  10.9) 

Only  used  in  task  performance  agent  interaction 
model.  Weights  for  selecting  an  agent  interaction 
purpose.  An  agent  selects  one  purpose  out  of 
three,  requested  organizational  element  (expertise 
or  resource)  delivery,  his  required  element  re¬ 
quest  to  others,  or  passing  others’  request  to  dif¬ 
ferent  others. 

Interaction  count  for  time- 
step  (3) 

Social  interaction 
(Table  10.9) 

An  agent  cannot  interact  with  another  agent  after 
this  maximum  interaction  count. 

Cognitive  power  for  time- 
step  (3) 

Social  interaction 
(Table  10.9) 

An  agent  can  only  respond  to  the  number  of  inte¬ 
ractions  specified  by  this  parameter. 

Exchange  success  rate 
(0.75) 

Social  interaction 
(Table  10.9) 

If  an  agent  diffuses  information  or  passes  a  re¬ 
source  to  another  agent,  there  is  a  success  rate  of 
such  trials. 

Interaction  social  distance 
radius  (1) 

Social  interaction 
(Table  10.9) 

Interaction  candidates  are  limited  to  agents  who 
are  within  N  social  link  radius  from  the  interac¬ 
tion  initiating  agent. 

Task  execution  success 
rate  (0.5) 

Perform_task 
(Table  10.11) 

When  an  agent  performs  a  task,  the  agent  can 
accomplish  the  task  with  this  success  rate.  If  the 
task  is  not  ready  (the  ready  state  is  elaborated 
later),  an  agent  cannot  perform  the  task. 
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TABLE  10.13  Virtual  experiment  design  for  simulation  parameters  (30  replications,  2500  simu¬ 
lation  time-steps) 


Name 

Value 

Implication 

Removal  target 

selection 

scheme 

Degree,  Betweenness,  Eigen¬ 
vector  centralities  and  Cogni¬ 
tive  Demand  (4  cases) 

Agents  with  high  network  values  are  con¬ 
sidered  critical,  and  their  removal  should 
impact  the  organization.  This  is  how  we 
pick  target  agents  to  remove. 

Intervention  size 

1,  5,  9,  and  12  agent  removals 
(of  19  agents  total,  4  cases) 

The  intervention  size  specifies  how  many 
agents  to  remove  with  this  intervention. 

Intervention 

timing 

125,  250,  500,  and  1000  time- 
step  (removing  at  after  5%, 
10%,  20%  and  40%  timeflow, 

4  cases) 

The  intervention  happens  at  a  specific 
stage  of  simulation  period. 

Total  virtual  experiment  cells:  64  cells  (4x4x4  cases) 

10.4.7  Results 

The  question  we  are  trying  to  examine  is  how  large,  how  early,  and  what  kinds  of  agents  are  the 
best  to  remove  to  significantly  impact  the  performance  of  an  adversarial  organization. 

Results  differ  slightly  from  the  social-only  model  previously  discussed.  Table  10.14  is  the 
regression  analysis,  which  compares  end-run  (after  all  2500  turns  have  concluded)  performance 
for  each  simulation.  As  could  be  predicted,  the  size  of  the  intervention  has  the  most  drastic  ef¬ 
fect  on  the  organization’s  performance.  Larger  interventions  impact  performance  more.  Earlier 
interventions  tend  to  have  much  larger  impacts  than  late  interventions.  There  is  no  clear  trend 
among  the  various  selection  schemes,  although  there  is  some  indication  that  different  selection 
criteria  should  be  used  for  different  mission  objectives. 

Table  10.14  A  table  of  standardized  coefficients  for  regression  to  the  six  organizational  perfor¬ 
mance  metrics  at  the  end  time  using  the  virtual  experiment  settings  (treating  removed  agent  se¬ 
lection  scheme  with  four  categorical  values)  (N=64  cases)  (*  for  P<0.05) 


Standardized  Coef¬ 
ficient 

Mission 

Speed 

Task 

Speed 

BTA 

ETA 

Diffusion 

Task  Com¬ 
pletion 

Intervention  Tim¬ 
ing 

0.521* 

0.355* 

0.470* 

0.129* 

-0.142* 

0.602* 

Intervention  Size 

-0.663* 

-0.337* 

0.013 

-0.981* 

0.975* 

-0.630* 

Degree  Cent. 

-0.058 

0.142 

0.036 

0.040 

-0.027 

0.002 

Betweenness  Cent. 

0.053 

0.073 

0.092 

0.018 

-0.023 

0.050 

Eigenvector  Cent. 

-0.008 

0.090 

0.017 

0.013 

-0.010 

-0.012 

Cognitive  Demand 

0.000 

0.000 

0.000 

0.000 

0.000 

0.000 

Adjusted  R-Square 

0.678 

0.171 

0.144 

0.960 

0.952 

0.725 

Figure  10.12  shows  the  organizational  performance  over-time.  In  terms  of  Energy  Task  Ac¬ 
curacy  and  Diffusion,  removing  more  terrorists  increases  the  inflicted  damage  (as  can  be  seen  in 
the  largest  interventions).  However,  from  the  task  completion  perspective,  early  interventions 


28 


are  more  important  and  their  impacts  to  the  organization  are  prolonged.  This  suggests  that  the 
intervention  tactic  should  be  adjusted  according  to  the  objective  of  the  intervention.  If  a  human 
analyst  wants  to  stop  the  spread  of  expertise  and  aligning  resource  distributions,  then  the  analyst 
should  focus  on  removing  more  agents.  If  the  analyst  wants  to  prevent  an  event  occurring,  then 
the  analyst  should  focus  on  removing  agents  earlier. 

Additionally,  it  should  be  noted  that  the  late  interventions  (removing  agents  after  40%  of 
time-steps)  and  the  small  interventions  (removing  only  10%  of  agents)  do  not  make  significant 
damage  in  task  completion  over  time.  Therefore,  such  interventions  do  not  result  in  the  disrup¬ 
tion  of  adversarial  task  performance  and  should  be  avoided. 

Further,  patterns  of  movement  can  be  described.  The  training  center  in  Somalia  and  the  re¬ 
source  center  in  Afghanistan  attract  agents  (with  Pakistan  serving  as  a  go-between)  until  neces¬ 
sary  skills  and  resources  have  been  acquired.  Operations  occurred  in  both  Kenya  and  Tanzania 
and  as  actors  gained  training  and  resources,  they  tended  to  move  to  one  of  these  two  target  zones. 
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Fig.  10.12,  a,  b,  c,  d  Changes  in  task  metric  performance  due  to  interventions. 


Fig.  10.13  Agents  gathered  resources  and  skills  and  then  moved  to  operational  centers. 
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10.5  Conclusion 

Dynamic  Network  Analysis  (DNA)  has  a  wide  number  of  applications  vis-a-vis  reasoning  about 
adversarial  behavior.  Three  such  applications  have  been  described.  The  key  to  reasoning  about 
the  adversary  is  taking  social  networks  and  embedding  them  within  the  spatio-temporal  context. 
Organization  theory  and  task  processing  analysis  facilitate  this  embedding  by  providing  the  con¬ 
straints  and  enablers  on  task-related  activity. 

Future  work  should  build  on  this  spatio-temporal-network  reasoning.  Two  avenues  we  ex¬ 
pect  to  be  particularly  valuable  are:  1)  hierarchical  modeling  where  the  adversaries  and  blue- 
force  are  modeled  simultaneously  at  the  agent  and  the  group/organizational  level,  and  2)  multi¬ 
model  analysis  where  diverse  models  are  run  for  the  same  geo-temporal-network  context  and  the 
results  are  used  to  inform  each  other. 
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PART  IV:  MULTI-MODELING  AND  META-MODELING 


Chapter  11:  Introduction  to  Multi-modeling  and  Meta-modeling 
Chapter  12:  Meta-modeling  for  Multi-modeling  Interoperation 
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Chapter  1 1 


Multi-modeling  and  Meta-modeling  of  Adversaries  and  Coalition  Partners 
Alexander  H.  Levis,  Lee  W.  Wagenhals,  Abbas  K.  Zaidi,  Tod  Levitt 
11.1  Introduction 

No  single  model  can  capture  the  complexities  of  human  behavior  especially  when  interactions 
among  groups  with  diverse  social  and  cultural  attributes  are  concerned.  Each  modeling  language 
offers  unique  insights  and  makes  specific  assumptions  about  the  domain  being  modeled.  For  ex¬ 
ample,  social  networks  [58]  describe  the  interactions  (and  linkages)  among  group  members  but 
say  little  about  the  underlying  organization  and/or  command  structure.  Similarly,  organization 
models  [59]  focus  on  the  structure  of  the  organization  and  the  prescribed  interactions  but  say 
little  on  the  social/behavioral  aspects  of  the  members  of  the  organization.  Timed  Influence  net 
models,  [13],  [60]  a  variant  of  Bayesian  models,  describe  cause-and-effect  relationships  among 
groups  at  a  high  level. 

In  order  to  address  the  modeling  and  simulation  issues  that  arise  when  multiple  models  are  to 
interoperate,  four  layers  need  to  be  addressed  (Fig.  11.1).  The  first  layer.  Physical,  i.e..  Hardware 
and  Software,  is  a  platform  that  enables  the  concurrent  execution  of  multiple  models  expressed 
in  different  modeling  languages  and  provides  the  ability  to  exchange  data  and  also  to  schedule 
the  events  across  the  different  models.  The  second  layer  is  the  syntactic  layer  which  ascertains 
that  the  right  data  are  exchanged  among  the  models.  The  Physical  and  Syntactic  layers  have  been 
addressed  through  the  development  of  two  testbeds:  C2  Wind  Tunnel  (C2WT)  [61],  [62]  by 
Vanderbilt  University  in  collaboration  with  UC-Berkeley  and  George  Mason  University  (Appen¬ 
dix  E)  and  SORASCS  developed  by  CASOS  at  Carnegie  Mellon  University  (Appendix  F).  Both 
have  been  used  and  developed  further  in  this  project. 

Once  the  testbeds  are  available,  a  third  problem  needs  to  be  addressed  at  the  Semantic  layer, 
where  the  interoperation  of  different  models  is  examined  to  ensure  that  conflicting  assumption  in 
different  modeling  languages  are  recognized  and  form  constraints  to  the  exchange  of  data.  In  the 
Workflow  layer  valid  combinations  of  interoperating  models  are  considered  to  address  specific 
issues.  Different  issues  require  different  workflows.  The  use  of  multiple  interoperating  models  is 
referred  to  as  multi-modeling  while  the  analysis  of  the  validity  of  model  interoperation  is  referred 
to  as  meta-modeling.  Such  an  approach  has  been  used  in  simulation  mode  or  to  explore  the  poss¬ 
ible  outcomes  of  proposed  courses  of  action;  it  has  not  been  used  to  predict  outcomes. 

In  this  chapter,  we  focus  on  issues  relating  to  the  syntactic  and  semantic  layers.  First,  in  sec¬ 
tions  11.2  and  11.3  the  concepts  of  multi-modeling  and  meat-modeling  are  explored.  Both  are 
subjects  on  which  some  basic  research  has  been  done  but  much  more  needs  to  be  done.  The 
modeling  languages  currently  implemented  in  the  C2WT  are  described  briefly  in  section  1 1 .4.  In 
section  1 1.5,  the  approach  taken  for  the  meta-modeling  analysis  is  presented.  Finally,  in  Section 
11.6,  the  approach  is  illustrated  through  a  complex  scenario  that  involves  Intelligence  and  Sur¬ 
veillance  in  order  to  defeat  adversaries  from  using  lEDs  and  developing  weapons  of  mass  de¬ 
struction  (WMD). 
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Workflow  Layer 


Semantic  Layer 


Syntactic  Layer 


Physical  Layer 


Fig.  11.1  The  four  layers  of  multi-modeling 


11.2  Representation  Issues  in  Meta-Modeling  for  Multi-Modeling 

When  we  work  in  multi-modeling  we  actually  are  working,  either  implicitly  or  explicitly,  over  at 
least  five  levels  of  abstraction: 

1 .  Meta-Modeling  Language 

2a.  Meta-Model  of  the  Domain  Application  Area 

2b.  Meta-Model  of  the  Model  Type 

3.  Model  Type 

4.  Model  Type  Specialization  to  Domain  Application  Area 

Typically  only  level  3,  the  model  type,  is  explicitly  specified.  For  example  we  may  build  an 
influence  diagram  by  using  the  Pythia  tool  (Appendix  B)Error!  Reference  source  not  found., 
and  even  though  it  is  being  done  to  analyze  military  courses  of  action  (CoAs)  there  is  no  explicit 
representation  of  a  CoA  as  a  class,  nor  are  the  actions  in  the  CoA  called  out  as  being  of  class  “ac¬ 
tion”.  Rather  the  CoA  generation  is  a  method  that  outputs  a  sequence  of  instances  of  the  class 

“proposition”,  because  the  meta-model  of  the  model  type,  “influence  network”  is  about  links  that 
are  of  class  “influence”  between  nodes  that  are  of  class  “proposition”  as  shown  in  Fig.  1 1.2.  Fur¬ 
thermore,  the  meta-model  of  Fig.  1 1.2  is  typically  only  kept  in  mind  of  the  researcher,  rather  than 
being  explicitly  represented. 

Meta-modeling  for  multi-modeling  has  even  greater  complexity  because  of  the  distinction 
between  knowledge  representation  of  the  world  for  domain-specific  reasoning  and  knowledge 
representation  of  software  for  building  and  executing  domain-specific  models.  Figure  11.3  pic¬ 
tures  the  issues. 
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Fig.  11.2  Influence  Network  meta-model 
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Fig.  1 1.3  Representation  of  knowledge  and  software 


The  distinctions  between  knowledge  representation  for  reasoning  about  things  in  the  world 
versus  that  needed  to  build  scalable,  maintainable  software  has  been  sharpened  over  the  last  dec¬ 
ade  by  efforts  to  develop  software  standards  supporting  the  World  Wide  Web  (WWW)  [63] 


Historically  the  Unified  Modeling  Language  (UML)  [64],  among  others,  was  developed  in 
response  to  the  need  for  abstract  representations  and  specifications  for  building  maintainable, 
scalable  software. 


However  the  need  to  search  and  reason  about  information  available  on  the  WWW  pushed  the 
distinction  between  data  as  knowledge  for  general  use  versus  data  as  inputs  to  computer  pro¬ 
grams  and  led  to  the  development  of  formal  ontologies,  notably  the  Resource  Description 
Framework  (RDF)  [65]  and  the  Web  Ontology  Language  (OWL)  [66]  for  reasoning  about  know¬ 
ledge  independent  of  the  goal  of  writing  a  specific  software  system.  In  addition  knowledge  man- 
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agement  frameworks  such  as  Protege  [67]  were  developed  for  working  with  knowledge  represen¬ 
tations  independent  of  specific  software  models. 

This  has  led  to  the  necessity  to  unify  and  move  agilely  between  OWL-like  reasoning  about 
knowledge  and  UML-like  engineering  of  software,  see,  for  example,  [68],  Multi-modeling  in 
particular  requires  this  capability. 

When  we  investigate  the  world,  for  example  to  learn  about  decision  makers  and  decision 
making  processes  in  a  foreign  country,  we  incrementally  discover  knowledge  distinctions  that 
cause  us  to  augment  and  revise  previous  representations  we  might  have  developed.  For  example 
we  might  find  that  a  Dr.  Smith  was  involved  in  a  debate  on  the  use  of  nuclear  weapons  and  then 
later  find  out  that  she  is  the  Director  of  Nuclear  Weapon  Development  for  the  country  of  interest. 

From  an  ontological  viewpoint  we  have  either  changed  Dr.  Smith’s  class  representation  or, 
more  likely,  added  properties  to  her  class  representation  as  an  agent  including  that  she  is  a  mem¬ 
ber  of  the  government,  and  that  she  holds  a  specific  office  in  the  government. 

In  the  OWL  sense  of  ontological  knowledge  representation,  we  have  specialized  the  class(es) 
to  which  Dr.  Smith  is  a  member,  because  a  class  represents  the  ontological  category  for  Ms. 
Smith  as  an  individual  in  the  world,  and  therefore  as  a  “resource”  in  OWL. 

Although  we  could  make  such  distinctions  in  the  UML  representation  of  Dr.  Smith  we  have 
probably  not  done  so  unless  it  is  necessary  for  the  execution  of  a  software  model  in  which  Dr. 
Smith  appears  as  data.  For  example  her  communications  on  nuclear  weapons  might  appear  as 
propositions  in  an  influence  network,  but  the  fact  that  she  a  member  of  the  government  organiza¬ 
tion  is  not  explicitly  represented  because  it  is  not  needed  for  any  distinctions  implicitly  made  by 
the  inference  methods  that  operate  in  the  influence  network  model. 

More  generally  OWL  is  about  representing  distinctions  about  the  world  that  ultimately  are 
observed  as  data,  while  UML  is  about  representing  distinctions  in  software  that  are  used  to  build 
tools  to  process  data. 

This  distinction  appears  in  the  fundamental  capability  in  OWL  to  make  logical  deductions 
that  can  infer  previously  unrepresented  properties  about  individuals  observed  in  data,  whereas 
UML  has  no  comparable  facility.  From  the  software  development  viewpoint,  such  inferences 
would  only  be  done  by  a  tool  that  was  built  using  a  UML  specification. 

Conversely  UML  has  capabilities  to  specify  distinctions  about  data  encapsulation  within  ob¬ 
jects  instantiated  from  class  representations  and  to  set  default  values  whereas  OWL  does  not  be¬ 
cause  “class  instantiation”  and  “data  encapsulation”  are  not  inherent  properties  of  world  entities. 
From  the  OWL  perspective  such  representations  would  be  done  by  custom-built  facilities  reason¬ 
ing  about  world  sub-domains  (e.g.  software  itself)  where  such  distinctions  hold. 

When  we  do  multi-modeling  we  need  both  kinds  of  reasoning  and  representation.  On  the  one 
hand  we  need  to  seed  models  with  knowledge  derived  by  an  ontologically-driven  search  of  avail¬ 
able  data  sources.  Then  we  need  to  use  that  observed  and  inferred  data  to  do  multi-modeling  with 
different  models,  to  better  understand  or  solve  a  problem  (in  the  world).  Inter-operations  between 
models  that  can  realize  such  insights  or  solutions  must  be  done  in  a  formal  software  manner  if 
they  are  to  be  effective,  maintainable  and  re-useable. 

Meta-languages  have  been  developed  to  support  inter-operation  between  OWL-like  and 
UML-like  reasoning,  notably  the  Meta-Object  Facility  (MOF)  [69].  MOF  can  be  used  to  specify 
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representations  in  both  OWL  and  LFML.  In  fact  MOF  is  used  to  represent  MOF  itself  closing  the 
implicit  loop  on  meta-representation  [70],  Kermeta  [71]  is  a  MOF  extension  language  that 
enables  not  only  specification  but  also  software  execution  of  meta-models. 

11.3  Meta-Modeling  Operations  for  Multi-Modeling  (M40ps) 

In  research  performed  so  far  we  have  identified  five  types  of  meta-modeling  operations  for 
performing  multi-modeling. 

•  Concatenation:  models  share  representations  and  so  can  get  instances  from  each  other 

•  Amplification:  model  adds  or  augments  class  representation  from  another 

•  Parameter  Discovery:  one  model  provides  parameters  for  algorithms  to  another  model’s  method 

•  Model  Construction:  one  model  is  used  to  constmct  models  of  another  type 

•  Model  Merging:  meta-model  for  a  new  model  type  is  created  that  merges  stmcture  from  one 
model  with  methods  If  om  another 

In  the  case  of  concatenation  because  the  models  share  the  same  class  representations  in  question, 
no  data  translation  needs  to  be  performed.  Concatenation  is  pictured  in  Fig.  1 1.4. 


*  Same  classes  shared  between  models  A  and  B 

•  New  class  Instances  sent  from  A  to  B 


Fig.  11.4  Concatenation 

Amplification  to  date  is  performed  manually  by  implicitly  translating  a  representation  in  one 
model  to  another  representation  in  another  model.  We  use  the  notation  A*^  to  mean  the  meta¬ 
model  representing  the  structure  and  methods  of  model  A.'  In  Fig.  11.5  we  use  the  notation 
“meta-query”  to  mean  the  human  interaction  to  query  for  ontological  knowledge  that  might  be 
resident  in  model  B  but  relevant  to  model,  A  if  an  appropriate  class  re-mapping  was  invoked.  For 
example  a  “decision-maker”  in  model  B  might  be  re-mapped  to  an  “agent”  in  model  A.  In  the 
formal  meta-modeling  operation  we  augment  the  meta-model  in  model  A,  i.e.  A”^,  a  specializa¬ 
tion  of  the  class  “agenf  ’  called  “decision-maker”  would  be  created.  Thereafter  data  searches  for 
instantiation  of  models  of  type  A  would  include  looking  for  “decision-makers”. 


'  It  is  technically  necessary  to  distinguish  the  meta-model  of  a  generic  model  of  type  A,  such  as  a  generic  Petri  net 
model,  versus  the  meta-model  of  an  instantiated  model  of  the  use  of  a  Petri  net  to  represent,  for  example,  the 
membership  and  communication  relationships  in  an  organization.  At  this  point  in  multi-modeling  research  we 
have  not  developed  the  technology  far  enough  to  merit  making  such  distinctions  in  notation.  It  will  be  necessary 
in  future  versions  of  this  report. 
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•  Meta-query  requires  knowledge  not  resident  in  model  A 

•  Model  A  meta-model  augmented  by  refactoring  with  B’s  meta-model 

•  A  acquires  new  classes  and  new  instances 


Fig.  11.5  Amplification 


Parameter  Discovery  occurs  when  on  model  uses  another  as  a  supplier  of  method  parameters. 
This  can  be  done  in  a  “concatenation  mode”  where  the  parameters  produced  by  model  B  are  of 
the  same  class  as  those  required  by  the  method  of  model  A.  However  it  can  be  that  the  parame¬ 
ters  produced  by  model  B  require  translation,  or,  alternatively,  the  parameters  of  the  method  of 
model  A  need  to  be  augmented  to  match  the  classes  of  those  in  model  B.  (Fig.  1 1.6) 
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parameters  for  methods 


♦  Query  for  parameters  needed  to  execute  A’s  method 

♦  B  performs  a  discovery  process  to  find  and/or  compute  parameters 

•A  can  build  new  knowledge  using  its  method  that  now  has  necessary  parameters 


Fig.  11.6  Parameter  Discovery 


Model  Construction  addresses  the  case  when  one  model  serves  as  a  factory  for  constructing 
models  of  a  different  type.  For  example  a  model  that  learns  Bayesian  networks  from  data  is  a 
constructor  for  Bayesian  network  models.  Note  that  there  could  be  multiple,  different  Parameter 
Discovery  operations  that  provided  data  to  such  a  constructor  operation.  For  example  there  might 
be  one  Parameter  Discovery  operation  that  searches  the  WWW  for  data  to  feed  a  Bayesian  net¬ 
work  constructor  model,  and  another  Parameter  Discovery  operation  that  searches  relational  da¬ 
tabases  for  parameters  for  the  Bayesian  network  constructor  model.  (Fig.  1 1.7)  This  illustrates 
the  reason  for  distinguishing  the  “operation”  from  the  “model”.  This  distinction  needs  clarifica¬ 
tion. 
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•  Model  A  is  a  “factory”  for  models  of  type  B 

•A  can  build  multiple  different  instantiations  of  models  of  type  B 
e.g.  learning  models  from  data 


Fig.  1 1 .7  Model  Construction 

In  “Model  Merging,”  a  new  model  type  is  created  that  merges  (part  of)  the  class  structure 
from  one  model  with  one  or  more  methods  from  another  model. 


«  Model  A  contributes  a  structure,  such  as  a  relation  between  agents 

•  Model  B  contributes  a  method,  such  as  an  inference  algorithm 

•  A  mixture  of  meta-models  from  A  and  B  is  used  to  construct  a 
meta-  model  of  a  new  model  type,  C,  that  can  execute  the  method  of 
B  over  the  structure  of  A 


Fig.  11.8  Model  Merging 


For  example  we  can  envision  developing  an  organizational  membership  model  (a  type  of  so¬ 
cial  network  model)  with  a  probabilistic  inference  method  (from  a  Bayesian  network  model  type) 
in  order  to  create  a  model  in  which  one  can  probabilistically  project  the  growth/decay  or  general 
health  status  of  the  organization. 

11.3  Multi-Modeling 

Current  military  operations  need,  and  future  operations  will  demand,  the  capability  to  understand 
the  human  terrain  and  the  various  dimensions  of  human  behavior  within  it.  Behaviors  in  the  hu¬ 
man  terrain  context  extend  across  the  spectrum  from  adversaries  to  non-combatant  populations, 
to  coalition  partners,  and  to  government  and  non-government  organizations.  As  the  type  of  mis¬ 
sions  that  current  and  future  commanders  must  address  has  expanded  well  beyond  those  of  tradi¬ 
tional  major  theater  combat  operations,  the  need  to  broaden  the  focus  of  models  that  support 
planning  and  operations  has  become  critical.  Actions  taken  by  all  agents  together  with  the  be¬ 
liefs,  perceptions,  intentions,  and  actions  of  the  people  involved  in  an  area  of  operations,  interact 
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to  affect  the  outcome  of  a  conflict  or  coalition  operation,  a  disaster  relief  plan,  and/or  a  peace¬ 
keeping  effort.  No  single  set  of  models  and  tools  can  support  the  operational  commander  ad¬ 
dressing  the  challenges  of  conducting  non-conventional  warfare  missions.  For  example,  while 
there  are  many  models  using  diverse  data  bases,  none  can  address  the  complexities  of  coordinat¬ 
ing  kinetic  and  Information  Operations  when  the  adversary  is  embedded  within  a  complex  non- 
combatant  population. 

The  MURI  team  at  George  Mason  University  and  Carnegie  Mellon  University  [72]  have  de¬ 
veloped  a  suite  of  models  that  address  different  aspects  of  modeling  the  attitudes  and  behaviors 
of  adversaries.  While  they  address  man-made  threats,  they  are  proof  of  the  concept  that  model 
interoperation  is  feasible.  A  subset  of  the  currently  available  suite  of  tools  is  shown  in  Fig.  1 1 .9. 
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Fig.  11.9  Modeling  applications  using  different  modeling  languages 


These  models  have  been  described  in  Parts  II,  III,  and  IV  of  this  report.  Consequently,  only  a 
brief  description  is  given  here.  CAESAR  III  [73]  is  a  Colored  Petri  Net  tool  for  designing  and 
analyzing  organizational  structures.  The  Timed  Influence  Net  application,  Pythia  [38],  [22]  is 
used  to  develop  Courses  of  Action  and  compare  their  outcomes.  Temper  [74]  is  a  temporal  logic 
inference  tool  that  is  used  to  address  the  temporal  aspects  of  a  course  of  action.  Ruler  [75]  is  a 
tool  for  evaluating  whether  a  proposed  course  of  action  is  in  compliance  with  the  prevailing  legal 
and  regulatory  environment.  SEAT  is  a  tool  for  visualizing  and  comparing  the  results  of  the  si¬ 
mulations  with  measures  of  performance  and  measures  of  effectiveness. 

ORA  [76]  is  an  application  for  the  construction  and  analysis  of  social  networks  while  DyNet 
[77]  is  a  computational  model  for  network  destabilization.  In  addition,  WebTAS  [78],  a  GFE 
visualization  and  timeline  analysis  tool  developed  by  AFRL/RI  that  accesses  data  in  data  bases 
and  can  receive  streaming  live  data  form  sensors,  has  been  integrated  in  the  C2  Wind  Tunnel 
thus  enabling  showing  data  and  results  on  maps.  Each  of  these  federates  uses  a  different  model¬ 
ing  language  and  a  different  simulation  engine. 

Multi-modeling  can  serve  as  a  means  of  reducing  data  ambiguity  and  identifying  missing  da¬ 
ta.  For  example,  by  comparing  two  distinct,  incomplete  models  and  using  inferences  from  one 
model  to  inform  the  other,  a  much  less  ambiguous  representation  of  the  system  of  interest  can  be 
obtained.  When  this  approach  is  coupled  with  meta-modeling  research  to  determine  what  infe¬ 
rences  from  one  model  can  be  validly  “exported”  to  another,  the  opportunity  arises  for  exploring 
ambiguity,  uncertainty,  and  missing  data  issues. 
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Effective  multi-modeling  requires  that  the  modeling  languages  used,  the  models  themselves, 
and  the  supporting  data,  do  not  contain  assumptions  that  invalidate  the  specific  model  interopera¬ 
tion.  This  leads  to  the  need  for  meta-modeling  analysis. 

11.4  Meta-Modeling 

With  the  capability  provided  by  the  C2WT  infrastructure,  different  models  addressing  the  same 
problem  can  be  utilized,  all  drawing  upon  the  same  data  set.  This  provides  a  means  for  exploring 
the  suitability  of  using  models  of  different  resolution  and  exploring  their  range  of  applicability 
through  computational  analysis  and  evaluation. 

Our  approach  to  understand  modeling  language  semantics  so  that  multiple  models  can  be  used 
together,  i.e.,  can  interoperate,  has  been  to  use  concepts  maps  [79]  to  describe  the  characteristics 
of  the  set  of  modeling  languages  and  data  that  are  available  to  support  analysis.  A  fragment  of 
the  concept  map  for  the  Timed  Influence  Net  modeling  language  is  shown  in  Fig.  1 1.10.  A  de¬ 
tailed  description  of  the  approach  is  given  in  the  next  chapter  (Chapter  12). 


Fig.  11.10  Fragment  of  the  concept  map  for  Timed  Influence  Nets. 

Meta  Modeling  analysis  indicates  what  types  of  interoperation  are  valid  between  models  ex¬ 
pressed  in  different  modeling  languages.  Note  that  model  interactions  can  take  a  wide  variety  of 
forms:  (1)  One  model  runs  inside  another;  (2)  Two  models  run  side-by-side  and  interoperate.  The 
interoperation  can  be  complementary  where  the  two  run  totally  independently  of  each  other  sup¬ 
plying  parts  of  the  solution  required  to  answer  the  questions,  or  supplementary  where  the  two 
supply  (offline  and/or  online)  each  other  with  parameter  values  and/or  functionality  not  available 
to  either  individual  model;  and  (3)  One  model  is  run/used  to  construct  another  by  providing  de¬ 
sign  parameters  and  constraints  or  constructs  the  whole  or  part  of  another  model  (Fig.  11.11). 
These  are  all  aspects  of  the  need  for  semantic  interoperability. 
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We  assume  that  two  models  can  interoperate  (partially)  if  some  concepts  appear  in  both 
modeling  languages.  By  refining  this  approach  to  partition  the  concepts  into  modeling  language 
input  and  output  concepts  and  also  defining  the  concepts  that  are  relevant  to  the  questions  being 
asked  by  the  analysts  and  decision  makers,  it  becomes  possible  to  determine  which  sets  of  mod¬ 
els  can  interoperate  to  address  some  or  all  of  the  concepts  of  interest,  and  which  sets  of  models 
use  different  input  and  output  concepts  that  are  relevant  to  those  questions. 

In  order  to  support  semantic  interoperability  we  must  be  able  to  interchange  models  across 
tools.  This  requires  model  transformations.  The  transformations  are  formally  specified  in  terms 
of  the  meta-models  of  the  inputs  and  the  outputs  of  the  transformations.  From  these  meta-models 
and  the  specification  of  the  semantic  mapping  we  synthesize  (generate)  a  semantic  translator  that 
implements  the  model  transformation.  [80] 


Fig.  11.11  Multiple  types  of  model  interoperation 


11.5  Human  Terrain  Example 

The  C2WT  technology  has  been  applied  to  several  different  defense-related  domains.  However, 
to  demonstrate  the  technology  and  the  use  of  the  C2WT  as  a  platform  for  computational  and 
mixed  initiative  experiments,  a  scenario  was  developed  that  required  the  inter-operation  of  sev¬ 
eral  disparate  models.  The  scenario  is  summarized  below. 

Blue  suspects  that  Red  is  engaging  in  the  development  of  WMD,  but  does  not  know  where 
the  development  is  being  done.  The  key  idea  of  the  scenario  is  that  Red  has  a  covert  house  in 
which  vehicle  home  improvised  explosive  devices  (VBIEDs)  are  manufactured  and  Red  is  also 
using  the  same  house  for  the  WMD  development.  Blue  does  not  know  that  they  co-located. 

Blue  has  some  limited  intelligence  about  both  of  these  activities  and  would  like  to  locate  the 
facilities.  A  shipment  by  truck  of  WMD  materials  provides  an  opportunity  for  Blue  to  discover 
the  WMD  factory.  However,  concurrently.  Red  decides  to  deploy  a  VBIED  following  his  usual 
Tactics,  Techniques  and  Procedures  that  have  proven  effective  in  the  past.  Blue  has  to  make  de- 
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cisions  as  to  how  to  allocate  scarce  ISR  assets  (two  Unmanned  Air  Systems,  UAS)  among  the 
two  Red  activities  while  at  the  same  time  he  wants  to  make  the  VBIED  ineffective  and  gather 
additional  intelligence  about  the  VBIED  making  factory.  A  cyber  cell  was  added  to  the  Blue  or¬ 
ganization  to  provide  additional  ISR  capabilities  (SIGINT)  for  Blue. 

The  scenario  was  designed  to  illustrate  the  benefits  of  information  sharing  over  networks.  If 
different  Blue  operators  and  decision  makers  share  the  information  that  they  collect  from  differ¬ 
ent  resources  in  a  timely  manner,  then  the  tactical  and  operational  level  commanders  will  be  pro¬ 
vided  with  the  maximum  information  that,  in  the  case  of  the  scenario,  results  in  Blue  locating  the 
combined  WMD  and  VBIED  factory  and  identifying  and  locating  the  VBIED  operation.  If  some 
of  the  information  is  not  shared  for  any  reason,  such  as  operator  error  by  the  Blue  operator  -  the 
UAS  pilots  -  or  Red  interference.  Blue  may  be  unable  to  identify  the  location  of  the  covert  bomb 
factory  or  track  the  VBIED  to  its  final  location. 

GoogleEarth  was  selected  as  the  scene  visualization  application  because  it  is  freely  available 
and  very  realistic.  Human  operators  may  be  used  to  control  the  two  UASs;  alternatively,  the 
UASs  may  fly  autonomously.  The  operators  received  directives  from  the  Colored  Petri  Net  re¬ 
presentation  of  the  CAOC  operators  and  the  information  from  the  UASs  was  sent  to  those  CAOC 
operators  over  the  simulated  network  modeled  in  OMNeT++. 

Figure  11.12  shows  some  of  the  screens  generated  by  the  execution  of  this  scenario  on  the 
C2WT.  One  screen  shows,  using  GoogleEarth,  what  the  sensors  on  the  UAS  sees;  the  second 
shows  what  the  human  operator  of  the  UAS  sees  after  the  sensor  data  are  transmitted  through  the 
network.  In  this  way,  the  effects  of  network  delays  or  jamming  or  cyber  exploits  can  be  observa¬ 
ble  directly.  Another  screen  shows  the  ground  truth  -  the  location  and  tracks  of  the  UASs  and  of 
the  targets  as  they  drive  through  an  urban  environment.  Still  another  screen  shows  the  situation 
reports  and  other  messages  that  go  through  the  system.  Finally,  when  the  driver  of  the  VBIED  is 
identified,  ORA  generates  the  social  network  to  which  he  belongs  and  thus  helps  identify  other 
actors  in  the  exploit. 

The  entire  scenario  with  all  federates  was  created  and  installed  on  multiple  computers  with 
several  large  screen  displays.  The  execution  of  this  particular  scenario  was  conducted  in  real 
time  because  of  the  presence  of  the  human  operators  and  lasted  about  20  minutes.  Furthermore, 
the  C2WT  was  instrumented  for  the  collection  of  data  so  that  excursions  from  the  scenario  could 
be  evaluated.  Two  extensions  were  created  to  the  main  scenario  involving  Red’s  use  of  jamming 
to  attempt  to  reduce  the  effectiveness  of  Blue.  In  the  first  case,  the  jamming  was  effective.  In  the 
second  case,  anti-jamming  procedures  were  employed  by  Blue  and  the  data  links  from  the  UASs 
to  the  CAOC  were  re-established.  However,  it  was  determined  that  the  length  of  the  time  interval 
during  which  the  signal  was  jammed  was  a  critical  parameter.  If  the  interval  was  too  long,  then 
the  UAS  was  not  able  to  re-acquire  the  target  in  the  urban  environment.  Currently,  a  series  of 
experiments  is  being  conducted  with  variants  of  this  scenario  exploring  the  effect  of  cyber  ex¬ 
ploits  on  performance. 
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Fig.  11.12  Large  Screen  Displays  for  C2WT  Demonstration 


11.6  Conclusions 

The  concept  of  multi-modeling  has  promise  for  addressing  the  complexities  of  modeling  adver¬ 
sary  behavior  especially  when  only  incomplete  data  are  available.  This  has  led  to  the  need  for 
research  on  meta-modeling  to  ascertain  that  the  interoperation  of  multiple  models  for  a  particular 
problem  is  valid.  Such  research  is  continuing  while  additional  federates  are  being  prepared  for 
installation  on  the  C2WT. 
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Chapter  12 


Meta-Modeling  for  Multi-Model  Interoperation 

M.  Faraz  Rafi,  Alexander  H.  Levis  and  Abbas  K.  Zaidi 


12.1  Introduction 

A  model  is  an  abstraction  of  a  real  phenomenon  capturing  some  aspects  of  a  domain  of  interest. 
The  analysis  performed  using  the  model  is  therefore  limited  to  only  those  aspects  that  are  ad¬ 
dressed  in  the  model  and  the  ability  of  the  modeling  language  (used  to  construct  the  model)  to 
allow  the  analysis  (i.e.,  queries  processed,  metrics  estimated,  etc.).  A  model  is  generally  con¬ 
structed  by  a  modeler  (e.g.,  a  subject  matter  expert  or  a  knowledge  engineer)  who  uses  relevant 
(i.e.,  relevant  to  the  problem  being  studied)  data  about  the  domain  for  which  the  model  is  being 
constructed  and  organizes  it  in  a  form  conformant  with  the  syntactical  and  semantic  rules  of  the 
modeling  language  employed  to  construct  it.  Figure  12.1  depicts  this  process  with  a  meta-model 
that  alludes  to  these  underlying  notions  of  modeling  language  requirements  and  the  relevant  data 
needed  for  this  model  building  exercise.  In  our  use  of  this  term,  a  meta-model  is  a  precise  defini¬ 
tion  of  the  constructs  and  rules  needed  for  creating  problem-specific  semantic  models.  [81]  The 
notion  of  a  meta-model  is  a  well  understood  term  especially  in  the  Software  and  System  Engi¬ 
neering  disciplines.  [82],  [83],  [84] 


Fig.  12.1  Model  building  overview 

The  modeling  of  a  human  conglomerate  for  the  analysis  of  its  behavior  in  response  to  exter¬ 
nal  (e.g.,  social,  economical,  political,  etc.)  stimuli  is  a  complex  problem  and  requires  develop¬ 
ment  of  an  ensemble  of  several  models.  Each  model,  in  this  set,  offers  unique  insights  and  makes 
specific  assumptions  about  the  domain  being  modeled  that  the  model  may  or  may  not  share  with 
another  model  of  the  same  domain.  For  example.  Social  Networks  [58]  describe  the  interactions 
(and  linkages)  among  group  members  but  say  little  about  the  underlying  organization  and/or 
command  structure.  Similarly,  organization  models  [59]  focus  on  the  structure  of  the  organiza¬ 
tion  and  the  prescribed  interactions  but  say  little  on  the  social/behavioral  aspects  of  the  members 
of  the  organization.  Timed  Influence  Net  models,  [13],  [85]  a  variant  of  Bayesian  models,  de¬ 
scribe  cause-and-effect  relationships  among  groups  at  a  high  level.  The  idea  of  using  a  variety  of 
techniques/models  to  solve  a  complex  modeling  and  analysis  problem  is  not  a  new  one:  an  earli- 
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er  survey  and  a  collection  of  papers  on  the  use  of  multiple  strategies  for  machine  learning  prob¬ 
lems  can  be  found  in  Michalski  and  Tecuci  [86],  Some  examples  of  more  recent  works  employ¬ 
ing  multi-modeling  are:  the  use  of  multiple  specialists  in  modeling  human  cognition  in  an  ap¬ 
proach  called  Polyscheme  [87],  [88];  integration  of  effects  based  (i.e.,  operational/strategic  level) 
and  attrition  based  (i.e.,  tactical  level)  models  to  study  effects  of  the  quality  of  the  commodity 
services  provided  by  an  infrastructure  on  the  socio-cultural  attitudes  and  actions  of  the  popula¬ 
tion  of  a  small  geographical  region  [89],  [13];  the  integration  of  First-order  Logic  with  Bayesian 
probability  theory  in  the  form  of  an  approach  called  MEBN  [90],  [91];  [92];  Interoperable  Tech¬ 
nosocial  Modeling  (ITM)  which  focuses  on  the  integration  and  evaluation  of  human  and  physical 
models  across  diverging  modeling  platforms,  e.g.  Bayesian  Nets  and  System  Dynamics  [93], 
[94],  [95],  and  the  interoperation  between  organizational  decision  models  and  socio-cultural  trait 
models  in  Kansal  et  al.  [96]  and  Levis  et  al.  [73]. 

Figure  12.2  depicts  a  multi-modeling  environment  where  each  individual  model  is  shown 
contributing  to  a  piece  of  a  larger  puzzle  (i.e.,  solution  to  the  problem  under  consideration)  with 
the  analysis  results  obtained  by  it.  The  figure  presents  an  over-simplification  of  possible  inter¬ 
operations  among  the  models  in  the  ensemble  employed  to  address  a  modeling  and  analysis 
problem.  A  variety  of  different  types  of  interactions  among  disparate  models  have  been  reported 
in  the  literature.  The  following  is  a  list  of  these  types  with  some  example  citations: 

1.  A  model-i  uses  another  model-j,  where  each  model  is  constructed  using  a  different 
modeling  language,  to  complete  a  computational/analysis  task.  For  example,  in  Wa- 
genhals  et  al.  [13]  a  Civil  Environment  Model  (CEM)  is  shown  to  provide  inputs  to  a 
Timed  Influence  Net  model  developed  for  effects  based  planning. 

2.  Two  or  more  models  run  concurrently  and  supply  complementary  parts  of  a  solution. 
This  case  is  also  depicted  in  Fig.  12.2. 

3.  A  model-i  supplements  the  computational/analysis  task  of  some  other  model-j  by 
providing  it  with  analysis  results  and/or  parameter  values.  For  example  in  Kansal  et 
al.  [96]  a  socio-cultural  trait  index  is  used  to  introduce  design  constraints,  incorporat¬ 
ing  cultural  attributes  of  a  group  of  individuals,  on  the  allowable  interactions  within 
an  organization.  The  organization  is  modeled  as  a  discrete-event  system.  In  Zaidi  et 
al.,  [27]  and  Haider  et  al.  [97]  a  temporal  modeling  and  reasoning  approach  is  em¬ 
ployed  for  a  Timed  Influence  Net  (TIN)  model  to  supplement  its  probabilistic  analy¬ 
sis  with  a  temporal  analysis  capability. 

4.  A  model-i  is  used  to  construct  the  whole/part  of  another  model-j.  For  example.  Moon 
et  al.  [98]  propose  an  approach  to  automatically  construct  a  Timed  Influence  Net 
(TIN)  model  from  a  Social  Network  and  a  rule  model.  A  similar  approach  is  pre¬ 
sented  in  [99]  that  attempts  to  construct  a  TIN  model  from  an  ontological  knowledge 
model  of  a  domain. 
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Fig.  12.2  A  multi-modeling  environment 

The  examples  of  interoperations,  cited  above,  involve  specific  models  of  some  domain  that 
are  linked  together  for  some  example  application.  Most  of  these  approaches  are  ad-hoc  in  the 
sense  that  they  do  not  provide  a  theoretical  underpinning  of  the  interoperations  presented  in 
them.  They  are  valid  for  the  example  instances  that  are  used  to  present  them  without  a  generali¬ 
zation  that  can  be  used  to  interoperate  any  two  (or  more)  models  expressed  in  the  same  modeling 
languages  as  the  example  models. 

In  this  chapter,  we  present  a  framework  for  a  formal  study  of  syntactic  and  semantic  intero¬ 
perability  of  disparate  models  and  modeling  languages  employed  to  address  a  specific  problem 
of  interest.  The  rest  of  the  paper  is  organized  as  follows:  Section  12.2  presents  the  Meta¬ 
modeling  approach  for  the  study  of  multi-model  interoperation  by  formalizing  the  overlaps 
among  models  expressed  in  different  modeling  languages.  The  details  of  an  application  of  the 
approach  are  presented  in  section  12.3.  This  application  uses  Social  Networks  and  Influence  Nets 
as  the  two  candidate  modeling  languages  for  the  development  of  a  meta-model  for  possible  inte¬ 
roperations  between  the  two  classes  of  models.  Section  12.4  analyzes  the  meta-model  developed 
in  Section  3.  Section  5  provides  concluding  remarks  and  directions  for  future  research. 

12.2  The  Meta-Modeling  Approach 

A  meta-model  is  an  abstraction  highlighting  properties  of  a  model  constructed  using  a  modeling 
language.  A  model  conforms  to  its  meta-model  in  the  way  that  a  computer  program  conforms  to 
the  grammar  of  the  programming  language  in  which  it  is  written.  The  presented  meta-modeling 
approach  is  an  analysis  of  the  conceptual  foundations  of  a  model  ensemble  so  that  individual 
models,  constructed  to  address  a  specific  problem  in  a  domain  of  interest,  can  interoperate  as  part 
of  a  workflow  developed  to  address  the  problem.  This  meta-modeling  approach  extends  earlier 
works  by  Kappel  et  al.  [100])  and  Saeki  and  Kaiya  [101]  for  a  class  of  modeling  languages  pri¬ 
marily  used  for  behavioral  modeling  problems. 
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It  is  a  phased  approach  that  uses  concept  maps,  syntactic-models,  and  ontologies.  It  is  based 
on  comparing  and  merging  the  ontologies  (for  each  modeling  technique)  to  help  identify  the  si¬ 
milarities,  overlaps,  and/or  mappings  across  the  models  under  consideration.  The  data  set  popu¬ 
lating  each  model  in  this  ensemble  may  have  been  derived  from  a  single  large  repository  of  in¬ 
formation  and  may  have  overlaps  (i.e.,  concepts,  relationships,  constraints,  etc.)  with  the  data 
sets  required  by  other  models.  We  assume  that  two  models  can  interoperate  (partially)  if  some 
concepts  appear  in  both  modeling  languages.  By  refining  this  approach  to  partition  the  concepts 
into  modeling  language  input  and  output  concepts  and  also  defining  the  concepts  that  are  rele¬ 
vant  to  the  questions  being  asked  by  the  analysts  and  decision  makers,  it  becomes  possible  to  de¬ 
termine  which  sets  of  models  can  interoperate  to  address  some  or  all  of  the  concepts  of  interest, 
and  which  sets  of  models  use  different  input  and  output  concepts  that  are  relevant  to  those  ques¬ 
tions. 

Figure  12.3  provides  an  overview  of  the  proposed  approach.  The  underlying  idea  is  to  first 
develop  separate  meta-models  for  the  different  modeling  languages  employed,  and  then  merging 
(or  comparing)  these  individual  models  into  a  unifying  meta-model  for  the  ensemble.  The 
merged  meta-model  identifies  the  similarities,  overlaps,  and/or  mappings  across  the  models  un¬ 
der  consideration  that  can  then  be  used  to  formalize  interoperation  among  these  models  in  a 
workflow. 

The  approach  starts  by  specifying  a  modeling  language  by  constructing  a  generalized  Con¬ 
cept  map  [102]  that  captures  the  assumptions,  definitions,  elements  and  their  properties  and  rela¬ 
tionships  relevant  to  the  paradigm.  This  is  termed  as  the  Conceptual  Modeling  Level  in  Fig.  12.3. 
This  concept  model  is  a  structured  representation,  albeit  not  a  formal  one,  and,  therefore,  not 
amenable  to  machine  reasoning.  The  knowledge  items,  i.e.,  concepts  and  roles,  captured  at  this 
level  represent  the  intensional  knowledge  [103]  about  the  problem  domain.  The  reason  for  con¬ 
centrating  only  on  the  general  knowledge  about  the  domain,  as  opposed  to  extensional  or  more 
specific  knowledge  about  the  instances  in  the  domain,  is  to  relate  concepts  and  roles  from  one 
modeling  paradigm  to  another.  Such  a  mapping,  if  established,  can  then  be  applied  to  the  exten¬ 
sional  knowledge  about  a  domain  to  instantiate  both  the  models  and  the  interoperations  between 
them  for  a  specific  problem/domain  of  interest.  The  Concept  map  representation  with  the  inten¬ 
sional  knowledge  is  then  formalized  using  syntactic  model.  The  aim  of  constructing  the  syntactic 
model  is  to  reveal  the  structural  aspects  of  the  modeling  technique  and  to  lay  down  the  founda¬ 
tion  for  its  ontology.  This  step  is  shown  as  the  Syntactic  Modeling  Level  in  Fig.  12.3.  A  basic  on¬ 
tology,  referred  to  as  a  pseudo  ontology,  is  constructed  which  mirrors  the  syntactic  model  and 
serves  as  the  foundation  ontology;  it  does  not  contain  any  semantic  concepts  (related  to  the  mod¬ 
eling  technique  and  to  the  modeled  domain)  but  acts  as  the  skeleton  for  the  ontology.  In  the  next 
step,  semantic  concepts  and  relationships  are  added  to  this  foundation  ontology  to  obtain  the  re¬ 
factored  ontology.  Once  the  individual  ontologies  are  completed  for  each  modeling  technique, 
mapping  of  concepts  across  the  ontologies  is  started.  The  resulting  ontology  which  contains  these 
concepts  and  relationships  within  and  across  multiple  ontologies  is  called  an  enriched  ontology. 
In  our  use  of  the  terms,  the  pseudo,  refactored,  and  enriched  ontologies  are  all  Description  Logic 
(DL)  [103],  [104]  knowledge  bases,  O  =  (Tbox,  Abox),  with  only  terminological  axioms.  In  our 
approach,  terminological  axioms  are  collection  of  concept  axioms  and  role  axioms  expressed  in 
OWL.  An  ontology,  as  defined  here,  has  semantics  similar  to  a  knowledge  base  expressed  in 
first-order  predicate  logic  with  implicit  knowledge  that  can  be  made  explicit  through  inferences. 
[103]  The  enriched  ontology  so  constructed  for  several  modeling  languages  can  therefore  be 
reasoned  with  using  the  logical  theory  supporting  the  ontological  representation  (i.e,  OWL).  The 
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inferences  applied  to  such  an  ontology  can  verify  the  consistency  of  concept  definitions  and  clas¬ 
sify  concepts  with  respect  to  subconcept- superconcept  relationships.  The  inference  mechanism, 
when  applied  to  the  enriched  ontology,  therefore,  can  identify  these  mappings  among  concepts 
across  different  modeling  languages.  The  mappings  suggest  possible  semantically  correct  ways 
to  ensure  consistency  and  to  exchange  information  (i.e.,  parameter  values  and/or  analysis  results) 
between  different  types  of  models  when  they  are  used  in  a  workflow.  The  steps  of  constructing 
the  pseudo,  refactored  and  enriched  ontologies  are  carried  out  as  part  of  Ontological  Modeling 
Level  in  the  proposed  approach  (Fig.  12.3). 
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Fig.  12.3  Overview  of  the  meta-modeling  approach 


12.3  Application 

In  this  section,  we  present  an  application  of  the  proposed  approach  of  Fig.  12.3  to  explore  intero¬ 
peration  between  two  modeling  languages  for  behavioral  modeling  problems.  The  two  modeling 
languages  selected  for  this  study  are  Social  Networks  [58]  and  Influence  Nets  [13].  Social  Net- 
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works  describe  the  interactions  (and  linkages)  among  group  members.  Influence  Net  models,  a 
variant  of  Bayesian  Networks,  describe  cause-and-effect  relationships  among  groups  at  a  high 
level.  A  considerable  number  of  models  for  real  world  scenarios  have  been  developed  and  ana¬ 
lyzed  using  both  techniques.  This  served  as  one  of  the  main  reasons  for  selecting  these  tech¬ 
niques  for  the  study  presented  in  this  paper.  A  brief  description  about  each  technique  follows: 

Influence  Nets 

Based  on  two  well  established  techniques,  i.e.  Bayesian  inference  net  analysis  and  Influence  dia¬ 
gramming  technique,  Rosen  and  Smith  [5]  proposed  a  formalism  called  Influence  net  to  perform 
probabilistic  modeling  in  order  to  model  the  rationale  of  some  group  or  organization.  In  an  Influ¬ 
ence  Net  model,  the  nodes  represent  random  variables  (propositions)  such  as  beliefs,  actions, 
events,  etc.,  whereas  an  edge  represents  a  causal  relationship  (influence)  between  two  nodes 
(propositions).  The  parent  and  child  nodes  are  often  called  cause  and  effect,  respectively.  The 
causal  relationship  between  a  cause  and  an  effect  can  either  be  promoting  or  inhibiting  as  identi¬ 
fied  by  the  edge  attributes  as  shown  in  Fig.  12.4.  In  Fig.  12.4,  Event  A  has  an  inhibiting  influence 
on  Event  B  and  a  promoting  influence  on  Event  C,  similarly  Event  B  has  a  promoting  influence 
on  Event  C.  A  UNIX  based  application  SIAM  supports  the  development  of  Influence  net  mod¬ 
els.  Another  Window  based  tool  called  Pythia  supports  modeling  of  the  timed  version  of  Influ¬ 
ence  Nets  called  Timed  Influence  Nets  (TINs). 

Social  Networks 

The  Social  Network  definition  used  in  our  study  is  of  Carley  [58],  where  a  Social  Network  is  a 
structure  composed  of  real  world  entities  and  associations  among  them.  In  this  definition,  a 
node,  or  an  entity,  can  be  an  agent,  organization,  action,  knowledge,  and/or  resource.  In  the  sam¬ 
ple  Social  Network  shown  in  Fig.  12.5,  the  circular  nodes  represent  entities  such  as  human  be¬ 
ings  and  the  edges  connecting  these  entities  represent  associations  (e.g.,  relationship)  between 
them.  These  associations  can  be  an  interaction  between  Albert  and  Cynthia  in  the  form  of  mutual 
discussions;  it  can  also  be  a  kinship  relationship  between  Branden  and  Debby.  The  graphical 
form  of  the  social  network  can  also  have  a  matrix  representation  in  which  the  entities  are 
represented  in  the  matrix  rows  and  columns  and  the  matrix  entries  indicate  their  interaction. 
ORA,  a  Social  Network  analysis  tool,  supports  constructing  these  matrices  and  the  models. 
These  matrices  can  either  be  single-mode  or  multi-modal.  Single-mode  matrices  represent  net¬ 
works  containing  only  one  type  of  entities  (e.g.,  people  or  agents  only)  while  multi-modal  ma¬ 
trices  consider  networks  with  multiple  types  of  entities  (e.g.,  agents,  action,  organizations,  know¬ 
ledge  etc.).  These  matrices  collectively  make  up  a  meta-matrix,  a  framework  that  integrates  mul¬ 
tiple  and  related  network  matrices  into  a  single  interrelated  unit  as  defined  by  Carley  [58]. 


Fig.  12.4  Example  Influence  Net 
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Fig.  12.5  Example  Social  Network 

The  following  is  a  detailed,  step-by-step,  description  of  the  approach  (Fig.  12.3)  when  it  is 
applied  to  the  two  modeling  techniques,  i.e.,  Social  Networks  and  Influence  Nets. 


Conceptual  Modeling  Level 

The  first  step,  in  our  approach,  is  the  construction  of  Concept  maps  for  each  modeling  language 
under  consideration.  In  a  Concept  map,  a  concept  is  represented  using  some  type  of  geometrical 
shape  (rectangular,  circular,  elliptical  etc.)  and  is  connected  with  other  concepts  using  a  directed 
link.  This  link  can  be  tagged  with  a  description  of  the  relationship  between  the  two  concepts. 
Concepts  connected  together  with  a  relationship  referring  to  a  meaningful  entity  define  a  propo¬ 
sition,  for  example.  Influence  Net  is  composed  of  Nodes  and  Links.  Concept  Influence  Net  is  con¬ 
nected  with  concepts  Node  and  Link  with  a  relationship  is  composed  of.  The  aim  of  constructing 
a  Concept  maps  for  both  Social  Networks  and  Influence  Net  is  to  gain  a  syntactic  and  semantic, 
albeit  informal,  insight  into  both  modeling  techniques  to  reveal  aspects  which  will  ultimately  fa¬ 
cilitate  the  ontology  construction  process  later  on.  The  construction  of  a  Concept  map  is  an  itera¬ 
tive  process  that  requires  brainstorming  and  frequent  revisions  until  a  final  and  concrete  Concept 
map  is  developed.  The  steps  of  constructing  a  Concept  map  include  identification  of  focus  ques¬ 
tions,  construction  of  parking  lot  (pool  of  concepts)  and  establishing  cross  links  between  these 
concepts. 

Figure  12.6  shows  a  fragment  of  a  Concept  map  constructed  for  Influence  Nets  in  an  attempt 
to  address  the  following  focus  question:  What  are  the  constructs  of  an  Influence  Net? 

Syntactic  Modeling  Level 

After  the  conceptual  modeling  level,  only  selected  concepts  from  it  are  formalized  to  represent 
the  structural  aspects  of  the  modeling  techniques  in  the  form  of  a  syntactic  model.  A  syntactic 
model  is  an  abstraction  layer  above  the  actual  models  and  can  be  considered  a  meta-model  de¬ 
scribing  the  syntactical  rules  and  requirements  for  the  construction  of  an  instance  model.  The 
objective  at  this  level  is  to  retrieve  a  basic  ontology  skeleton.  Syntactic  models  do  not  contain 
any  detailed  concepts  and  relationships  of  the  domains  they  model,  but  their  structure  can  be 
used  as  the  basis  for  the  first  ontology  to  be  constructed  in  the  next  level.  Figure  12.7  shows  the 
syntactic  model  for  the  Influence  Net  modeling  language. 
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Fig.  12.6  A  sample  Concept  Map  for  constructs  of  Influence  Net  focus  question 
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Fig.  12.7  Influence  Net  Syntactic  Model 

Ontological  Modeling  Level 

There  are  three  sub-levels  in  this  step  (Fig.  12.3)  that  eventually  yield  an  ontology  enriched  with 
concepts  and  relationships  from  both  modeling  languages.  Kappel  et  al.  [100]  refer  to  the  process 
of  formalism  shifting  as  reducing  the  gap  between  the  implementation  oriented  focus  of  syntactic 
models  and  the  knowledge  representation  oriented  focus  of  ontologies.  This  formalism  shift  is 
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led  by  the  syntactic  model  developed  in  the  previous  level.  We  have  adapted  the  technique  sug¬ 
gested  by  Kappel  et  al.  [100]  with  an  addition  of  the  Conceptual  Modeling  Level  as  the  first  at¬ 
tempt  in  understanding  the  underlying  syntactic  and  semantic  constructs  of  a  modeling  language 
and  the  generic  domain  concepts  that  are  used  in  the  models.  In  our  study,  we  manually  asserted 
some  semantic  equivalences  between  refactored  ontologies,  as  opposed  to  Kappel  et  al’s  use  of 
COMA++  tool. 

At  this  level,  the  first  ontology  that  is  constructed  is  called  pseudo  ontology  and  resembles  its 
syntactic  model  equivalent.  Explicit  domain  concepts  and  relationships  used  by  modeling  tech¬ 
nique  are  added  into  the  pseudo  ontology  to  construct  a  refactored  ontology.  Mapping  of  con¬ 
cepts  between  the  refactored  ontologies  of  both  techniques  is  partly  done  manually  and  partly  by 
invoking  the  DL  reasoner  to  construct  an  enriched  ontology.  This  enriched  ontology  contains  the 
individual  and  mapped  concepts  and  relationships  of  both  modeling  techniques.  It  can  be  consi¬ 
dered  as  a  template  ontology  which  contains  the  intra  and  inter-modeling  technique  concepts  and 
relationships.  An  ABox  of  this  ontology  can  be  instantiated  for  a  specific  domain  which  will 
serve  as  the  knowledge  container  for  that  domain. 

Pseudo  Ontologies 

In  the  first  sub-level,  the  pseudo  ontology  resembling  that  of  its  corresponding  syntactic  model 
has  no  explicit  concepts  present  except  the  ones  related  to  the  structure  of  the  modeling  tech¬ 
nique  similar  to  what  is  in  the  syntactic  model.  The  construction  of  this  ontology  utilizes  the  syn¬ 
tactic  model  in  such  a  way  that  each  syntactic  model  element  becomes  an  ontology  class  and  the 
association  between  the  syntactic  model  elements  becomes  either  an  object  or  a  data  property  in 
the  pseudo  ontology.  Figure  9  illustrates  the  pseudo  ontology  for  the  Influence  Net  modeling 
technique.  For  the  sake  of  brevity  only  a  small  fragment  of  the  ontology  is  shown. 


Fig.  12.8  Influence  Net  pseudo  ontology  snippet 
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Refactored  Ontologies 

Once  the  pseudo  ontology  construction  completes,  the  knowledge  obtained  from  the  Concept 
maps,  as  well  as  the  knowledge  of  the  designer  about  the  modeling  technique,  is  used  to  define 
and  feed  new  concepts  (classes)  and  relationships  (properties)  explicitly  into  the  pseudo  ontology 
to  construct  a  completely  specified  refactored  ontology.  Our  approach  adds  additional  concepts 
into  the  refactored  ontology  from  the  concept  mapping  phase  and  the  domain  knowledge  of  the 
ontology  designer.  Since  during  the  concept  mapping  phase,  a  large  number  of  concepts  were 
already  identified,  the  ontology  designer  can  make  use  of  that  repository  of  concepts  to  feed  into 
the  pseudo  ontology. 

The  class  hierarchy  views  of  the  refactored  ontologies  developed  for  Influence  Nets  and  So¬ 
cial  Networks  are  shown  in  Figure  12.9  and  12.10.  These  diagrams  were  generated  using 
GraphViz  plug-in  in  Protege  4.0  which  graphically  describes  how  the  classes  are  associated  (i.e., 
subclass,  superclass,  equivalent  class)  with  each  other  based  on  the  defined  object  properties 
(i.e.,  terminological  axioms).  Table  12.1  shows  the  concepts  imported  into  the  Influence  Net  re¬ 
factored  ontology  from  the  Concept  maps.  Similarly,  Table  12.2  shows  the  explicit  concepts 
added  into  the  refactored  ontology  of  Table  12.1.  Classes  subject,  object,  and  verb  form  the  con¬ 
stituents  of  Proposition  class.  The  classification  of  propositions  is  a  critical  step.  There  can  be 
many  types  of  propositions  besides  the  ones  shown  in  the  Figure.  The  actual  aim  is  to  come  up 
with  an  initial  set  of  proposition  types  that  are  the  most  recurrent  among  the  two  types  of  models 
studied.  Since  ontology  construction  is  an  iterative  process,  its  evolution  can  continue  over  time. 
As  new  types  emerge,  they  can  be  incorporated  as  new  classes  and  properties  into  the  existing 
ontologies.  Table  12.3  shows  the  concepts  imported  from  the  concept  maps  developed  for  Social 
Networks  into  the  Social  Network  refactored  ontology. 


Fig.  12.9  GraphViz  Diagram  -  Influence  Net  inferred  refactored  ontology. 
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Fig.  12.10  GraphViz  Diagram  -  Social  Network  inferred  refactored  ontology 
TABLE  12.1  Influence  Net  Refactored  Ontology  Elements  (Concept  Map  Imports) 


Ontology 

Ontology 

Ontology 

Concept  Map  -  Propositions 

Domain  Cla&E 

Object  Property 

Range  Glass 

Concept  1 

Relationship 

Concept! 

Action 

Action 

Ability 

Ability’ 

Proposition 

Belief 

Proposition 

can  define 

Belief 

Decision 

Decision 

Event 

Event 

Intent 

Intent 

TABLE  12.2  Explicit  Influence  Net  Concepts  in  Refactored  Ontology 


Category 

Ontology 
Domain  Class 

Ontology 

Object  Property 

Ontology 

Range  Class 

subject 

has  Subject  Value 

subject 

a 

<D 

verb 

has  Verb  Value 

verb 

0 

0 

object 

hasObjectValue 

object 

u 

outcome 

hasOutcome  V  alue 

outcome 

’0 

Evidence 

HasEvidence 

Evidence 

CL 

X 

quality 

hasQuality  V  alue 

quality 

w 

state 

hasStateValue 

state 

PropositionType 

hasPropositionType 

Affirmative,  Negative 
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TABLE  12.3  Social  Network  Refactored  Ontology  Elements  (Concept  Map  Imports) 


Category 

Ontology 

Ontology 

Ontology  1  Concept  Map  -  Propositions  | 

Domain  Class 

Object  Property 

Range  Class 

Concepts  from  Con¬ 
cept  Maps 

Perception 

hasPerception 

Value 

Action 

Perception 

Types 

Action 

Belief 

Belief 

Event 

Event 

Knowledge 

Knowledge 

Location 

Location 

Resource 

Resource 

Role 

Role 

Task 

Task 

Enriched  Ontology 

The  focus  of  the  effort  so  far  has  been  to  construct  an  enriched  ontology  fdled  with  the  concepts 
(classes)  and  relationships  (properties)  of  Influence  Net  and  Social  Network  modeling  techniques 
within  and  across  them.  The  motive  behind  the  construction  of  this  enriched  ontology  is  to  iden¬ 
tify  mappings  (i.e.,  subsumption  and  equivalence)  between  the  concepts  of  both  modeling  tech¬ 
niques  so  that  the  exchange  of  information  or  analysis  results  between  models  constructed  using 
both  techniques  can  be  formalized.  The  refactored  ontologies  serve  as  the  basis  for  the  enriched 
ontology. 

The  diagram  in  Fig.  12.1 1  illustrates  the  fusing  of  concepts  from  both  types  of  refactored  on¬ 
tologies  inside  the  enriched  ontology.  This  is  achieved  by  defining  additional  object  properties  in 
related  classes  and  asserting  them  in  the  new  ontology.  For  instance,  the  Agent  and  Organization 
classes  from  the  Social  Network  refactored  ontology  can  be  mapped  to  the  subject  and  object 
classes  of  the  Influence  Net  refactored  ontology  by  adding  hasSubjectValue  and  hasObjectValue 
object  properties  to  the  existing  object  property  of  Agent  and  Organization  classes.  Once,  the  on¬ 
tology  reasoner  is  executed,  it  classifies  Agent,  Subject,  Object,  and  Organization  as  equivalent 
classes  by  inferring  that  the  new  object  properties  added  to  the  Agent  class  map  Subject,  Object, 
and  Organization  to  itself  as  shown  in  Figure  12.12.  The  inferred  class  hierarchy  shows  these 
classes  with  the  equivalence  sign  (Figs.  12.12-12.14).  Similarly,  Belief  class  in  Social  Network 
refactored  ontology  can  be  mapped  to  Influence  Net’s  Belief  class.  The  Event  class  of  Social 
Network  refactored  ontology  maps  to  the  state  class  which  is  the  constituent  of  the  Event  class  in 
Influence  net  refactored  ontology  also  Social  network’s  Knowledge  class  maps  to  quality  class 
which  is  the  constituent  of  Ability  class  in  Influence  net  refactored  ontology.  The  class  Task  of 
Social  Network  can  be  mapped  to  the  class  verb  of  Influence  Net  refactored  ontology.  Table  4 
summarizes  these  mapped  concepts  between  the  two  refactored  ontologies.  The  ultimate  result  of 
this  mapping  is  an  enriched  ontology  which  is  the  knowledge  container  of  both  Influence  Net 
and  Social  Network  modeling  techniques.  The  class  hierarchy  view  of  the  obtained  enriched  on¬ 
tology  is  shown  in  Fig.12.15.  Note  that  the  ontology  in  Fig.  12.15  shows  both  the  asserted  and 
inferred  equivalences  and  relationships  among  concepts  from  both  Influence  Net  and  Social 
Network  refactored  ontologies. 
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Influence  Net  Refactored  Ontology 

Classes 

subject,  object,  verb 
Action  Proposition,  etc. 


Social  Network  Refactored 

Ontology  Classes 
Agent,  Organization,  Task 
Action,  etc. 


subject  (hasSubJectValue  some  subject  or  hasAgentValue  some  Agent  or  hasOrganizationValue  some  Organization) 
object  (hasObJectValue  some  object  or  hasAgentValue  some  Agent  or  hasOrganizationValue  some  Organization) 
Agent  (hasAgentValue  some  Agent  or  hasSubJectValue  some  subject  or  hasOrganizationValue  some  Organization) 
Organization  (hasAgentValue  some  Agent  or  hasSubJectValue  some  subject  or  hasObJectValue  some  object) 
verb  (hasVerbValue  some  verb  or  hasTaskValue  some  Task)  etc. 

Action  (hasElements  some  subiect.  verb  and  obiect  or  hasActlonValue  some  Action) 


Figure  12.1 1  Enriched  ontology  classes 
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Fig.  12.12  Subject,  Object 
classes  mapped  to  Agent  class 


Fig.  12.13  Reasoner  inferred 
equivalences 


Fig.  12.14  Subject,  Object, 
organization  and  Agent 
as  equivalent  classes 
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TABLE  12.4  Enriched  ontology 


Enriched  Ontology  (Influence 

Net  &  Social  Network  Refactored  Ontology  Mapped  Concepts) 

Influence  Net  Refactored  Ontology  Elements 

Social  Network  Refactored  Ontology  Elements 

Domain 

Class 

Object  Property 

Range  Class 

Domain  Class 

Object  Property 

Range  Class 

hasSubjectValue 

subject 

hasSubjectValue 

Subject 

subject 

has  Agent  Value 

Agent 

Agent 

hasAgentValue 

Agent 

hasOrganization  V  a- 
lue 

Organization 

hasObjectValue 

Object 

hasObjectValue 

Object 

hasObjectValue 

Object 

object 

has  Agent  Value 

Agent 

Organization 

hasAgentValue 

Agent 

hasOrganization  V  a- 
lue 

Organization 

hasSubjectValue 

Subject 

verb 

has  Verb  Value 

verb 

has  Verb  Value 

verb 

hasTaskValue 

Task 

hasTaskValue 

Task 

Intent/ 

Decision 

hasElements  some 
Action 

and  hasElements 
some  subject 
and  hasElements 
some  verb 

Action,  sub¬ 
ject,  verb 

Task 

hasElements  some 
Action 

and  hasElements 
some  subject 
and  hasElements 
some  verb 

Action,  sub¬ 
ject,  verb 

Action 

hasElements  some 
subject 

and  hasElements 
some  verb  and  ha¬ 
sElements  some  ob¬ 
ject 

Action,  sub¬ 
ject,  verb 

Action 

hasElements  some 
subject 

and  hasElements 
some  verb  and  ha¬ 
sElements  some 
object 

Action,  sub¬ 
ject,  verb 

has  Action  Value 

Action 

hasActionValue 

Action 

Belief 

hasElements  some 
subject 

and  hasElements 
some  verb 
and  hasElements 

some 

(Ability  or  Decision 
or  Action  or  Event) 
and  hasEvidence 
some  Evidence 

subject,  ob¬ 
ject,  verb. 
Ability  or 
Decision  or 
Action  or 
Event,  Evi¬ 
dence 

Belief 

hasElements  some 
subject 

and  hasElements 
some  verb 
and  hasElements 

some 

(Ability  or  Deci¬ 
sion  or  Action  or 
Event)  and  hasEvi¬ 
dence  some  Evi¬ 
dence 

subject, 
object, 
verb.  Abili¬ 
ty  or  Deci¬ 
sion  or  Ac¬ 
tion  or 
Event,  Evi¬ 
dence 

hasBeliefValue  some 
Belief 

Belief 

hasBeliefValue 
some  Belief 

Belief 

state 

hasState  Value 

State 

Event 

hasStateValue 

State 

hasE  vent  Value 

Event 

hasEventValue 

Event 

hasQuality  Value 

quality 

hasQuality  Value 

quality 

quality 

hasKnowledge  V  alue 

Knowledge 

Knowledge 

hasKnowledge  V  a- 
lue 

Knowledge 
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Figure  12.15  Class  hierarchy  of  the  inferred  enriched  ontology 
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The  process  described  in  this  section  is  repeatable  for  any  set  of  modeling  techniques.  For  in¬ 
stance,  to  extract  semantic  knowledge  about  CPN  (Colored  Petri  Net),  similar  Concept  maps  (for 
the  defined  focus  questions)  scan  be  developed,  followed  by  its  syntactic  model,  and  then  pseudo 
and  refactored  ontologies.  Ontology  construction  is  an  intense  brainstorming  activity.  By  the 
time  the  refactored  ontology  is  completed,  enough  insight  into  the  modeling  technique  should 
have  been  achieved  that  the  ontology  designer  would  easily  be  able  to  map  CPN  concepts  to  the 
related  Social  Network  or  Influence  Net  concepts  (if  any).  These  newly  mapped  concepts  can 
then  be  incorporated  into  this  enriched  ontology  and  an  updated  enriched  ontology  can  be  ob¬ 
tained  which  would  serve  as  the  knowledge  container  for  Influence  Net,  Social  Network  and 
CPN  modeling  techniques  altogether. 

12.4  Conclusion 

In  this  work,  we  made  a  formal  attempt  to  study  the  syntactic  and  semantic  interoperations 
among  disparate  models  employed  to  address  a  specific  problem  of  interest.  In  this  study,  we  ex¬ 
amined  the  interoperations  among  Social  Network  and  Timed  Influence  Net  models  that  are  con¬ 
structed  for  an  adversarial  behavior  modeling  problem.  The  approach  used  for  the  study  is  a 
phased  approach,  employing  a  combination  of  concept  maps,  syntactic-models,  and  ontologies, 
consisting  of  the  following  three  levels:  as  part  of  its  Conceptual  Modeling  Level,  it  specifies  a 
modeling  language  by  constructing  a  generalized  Concept  map  that  captures  the  intensional 
knowledge  about  the  problem  that  is  used  in  the  models  done  using  the  language;  in  the  Syntactic 
Modeling  Level,  the  structural  aspects  of  a  modeling  language,  in  the  context  of  the  problem 
domain,  are  formalized  as  a  UML  syntactic  model;  the  final  Ontological  Modeling  Level  starts 
by  exporting  the  syntactic  model  into  an  OWL  ontology  and  then  refactoring  and  enriching  it 
semantic  concepts  and  relationships.  Once  the  individual  ontologies  are  completed  for  each 
modeling  technique,  mapping  of  concepts  across  the  ontologies  is  started.  The  resulting  merged 
ontology  which  contains  these  concepts  and  relationships  within  and  across  multiple  ontologies 
is  called  a  merged  enriched  ontology. 

The  refactored,  and  enriched  ontologies  are  Description  Logic  (DL)  knowledge-bases  with 
terminological  axioms,  i.e.,  collections  of  concept  axioms  and  role  axioms  expressed  in  OWL.  In 
our  study  of  the  two  modeling  languages,  i.e..  Social  Networks  and  Timed  Influence  Net,  the 
discovered  mappings  in  the  merged  enriched  ontology  suggest  possible  semantically  correct 
ways  to  ensure  consistency  and  to  exchange  information  between  the  two  types  of  models  when 
they  are  used  to  solve  a  problem  of  interest  in  a  domain.  This  mapping,  in  a  practical  model 
building  exercise,  may  help  a  modeler  resolve  possible  ambiguous,  uncertain,  and  missing  data 
issues  by  identifying  what  concepts  can  validly  be  ‘exported’  from  one  model  to  another.  For 
example  in  our  study,  the  Agent  and  Organization  classes  from  the  Social  Network  ontology  is 
shown  mapped  to  the  subject  and  object  classes  of  the  Influence  Net  refactored  ontology  after  the 
ontology  reasoner  is  executed,  as  shown  in  Figure  12.12.  This  mapping  between  the  components 
of  the  two  types  of  model  can  help  determine  the  concepts  present  in  one  model  that  may  be 
missing  in  the  other,  provided  the  two  types  are  already  developed.  In  a  situation  where  one  of 
the  two  models  is  constructed  prior  to  the  other,  the  merged  enriched  ontology  informs  the  mod¬ 
eler  about  the  concepts  can  be  validly  ‘exported’  from  the  existing  model  for  the  construction  of 
the  other. 
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The  presented  study  of  the  two  modeling  languages,  Soeial  Networks  and  Timed  Influenee 
Net,  shows  the  promise  of  the  proposed  Meta-modeling  approaeh  for  a  Multi-modeling  frame¬ 
work  in  formalizing  the  possible  interoperations  between  the  two  types  of  models.  It,  however, 
only  identifies  interoperations  in  the  form  of  knowledge  items  that  the  two  modeling  techniques 
share  as  part  of  their  design  constructs.  A  semantically  more  detailed  and  richer  ontology  of  the 
two  may  take  this  mapping  to  other  levels  of  interoperations  as  outlined  in  Section  12.1. 
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PART  V:  COMPUTATIONAL  EXPERIMENT 

Chapter  13:  Cyber  Deterrence  Policy  and  Strategy 
Chapter  14:  Application:  The  India-Pakistan  Crisis  Scenario 
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Chapter  13 


Cyber  Deterrence  Policy  and  Strategies 

Robert  J.  Elder,  Alexander  H.  Levis 


13.1  Introduction 

Deterrence  as  practiced  during  the  Cold  War  was  largely  defined  in  terms  of  capabilities  to  im¬ 
pose  punishment  in  response  to  an  attack;  however,  with  growing  concern  over  the  proliferation 
of  nuclear  and  other  “mass  effecf’  technologies  such  as  cyber  technologies,  deterrence  has 
evolved  to  be  understood  more  generally  in  terms  of  cost/benefit  calculi,  viewed  from  not  only  a 
national  perspective,  but  also  recognizing  the  importance  of  both  friendly  and  competitor  pers¬ 
pectives.  With  this  more  holistic  approach,  the  primary  instruments  used  for  deterrence  are  those 
which  encourage  restraint  on  the  part  of  all  affected  parties.  The  use  of  a  multiple  lever  approach 
to  deterrence  offers  a  path  to  an  integrated  strategy  that  not  only  addresses  the  cost/benefit  calcu¬ 
lus  of  the  primary  attacker,  but  also  provides  opportunities  to  influence  the  calculus  of  mercenary 
cyber  armies  for  hire,  patriotic  hackers,  or  other  groups.  While  traditional  denial  and  punishment 
approaches  to  deterrence  may  not  apply,  the  broader  approach  to  deterrence  described  in  the  US 
Deterrence  Operations  Joint  Operating  Concept,  which  emphasizes  the  cost/benefit  relationship 
of  restraint  on  the  part  of  potential  adversaries,  offers  a  sound  foundation  for  deterring  cyber  con¬ 
flict  even  where  multiple  actors  are  involved.  This  suggests  that  the  strategic  concepts  of  escala¬ 
tion  control  and  extended  deterrence  which  developed  from  years  of  experience  with  nuclear  de¬ 
terrence  are  applicable  and  relevant  to  cyber  deterrence. 

The  letter  report  “Deterring  Cyber  Attacks:  Informing  Strategies  and  Developing  Options  for 
U.S.  Policy”^  posed  a  series  of  questions  regarding  opportunities  to  apply  the  strategy  of  deter¬ 
rence  developed  during  the  Cold  War  to  future  cyberdeterrence  strategies:  First,  is  there  a  model 
(or  modeling  approach)  that  might  appropriately  describe  the  strategies  of  state  actors  acting  in 
an  adversarial  manner  in  cyberspace?  And,  is  there  an  equilibrium  state  that  does  not  result  in 
cyber  conflict?  Second,  how  will  any  such  deterrence  strategy  be  affected  by  mercenary  cyber 
armies  for  hire  and/or  patriotic  hackers?  Third,  what  are  the  strengths  and  limitations  of  applying 
traditional  deterrence  theory  to  cyber  conflict?  Fourth,  what  lessons  and  strategic  concepts  from 
nuclear  deterrence  are  applicable  and  relevant  to  cyberdeterrence?  And  finally,  how  should  a 
U.S.  cyberdeterrence  strategy  relate  to  broader  U.S.  national  security  interests  and  strategy?  This 
paper  addresses  these  questions  and  suggests  that  the  use  of  multi-modeling  can  serve  as  a  po¬ 
werful  aid  to  cyberdeterrence  analysts  and  policymakers. 

Strategic  deterrence  during  the  Cold  War  was  defined  in  terms  of  capabilities  to  impose  pu¬ 
nishment  or  deny  benefits;  however,  with  growing  concern  over  the  proliferation  of  nuclear  and 


^  Letter  Report  for  the  Committee  on  Deterring  Cyberattacks;  Informing  Strategies  and  Developing 
Options  for  U.S.  Policy,  Committee  on  Deterring  Cyberattacks;  National  Research  Council,  March  25,  2010. 
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other  similar  “mass  effect”  technologies,  to  include  cyber  attack,  deterrence  has  evolved  to  be 
understood  in  terms  of  cost/benefit  calculi,  viewed  from  not  only  a  national  perspective,  but  also 
the  perceptions  of  friends  and  competitors.  The  evolving  primary  deterrence  objective  is  to  en¬ 
courage  restraint  on  the  part  of  all  affected  parties,  and  the  primary  means  is  to  establish  mutual 
understanding  among  actors  designed  to  prevent  one  actor  from  conducting  actions  or  exhibiting 
behaviors  that  are  unacceptable  to  one  another.  In  this  context,  the  instruments  of  deterrence  are 
not  only  the  capabilities  to  impose  punishment  or  deny  the  effects  of  adversary  actions,  but  also 
the  means  to  identify  friendly  and  competitor  vital  interests,  to  communicate  with  friends  and 
adversaries,  to  validate  mutual  understanding  of  redlines,  and  to  control  escalation. 

Consider  how  deterrence  was  conducted  during  the  Cold  War.  There  were  three  pillars  to  the 
Cold  War  deterrence  concept.  The  first  was  the  posturing  of  forces  and  capabilities  to  demon¬ 
strate  readiness.  The  second  was  the  conduct  of  visible  actions  which  showcased  capabilities. 
The  third  was  messaging  to  explain  the  activities  and  posture  changes  to  both  friends  and  poten¬ 
tial  competitors.  Messaging  was  also  used  to  outline  United  States  strategy  with  regard  to  nuc¬ 
lear  weapon  use,  particularly  with  respect  to  redlines.  It  is  worth  noting  that  ambiguous  messag¬ 
ing  is  a  message  in  itself,  even  if  not  intended!  The  United  States  postured  its  forces  by  putting 
them  on  alert  both  for  survivability  and  to  demonstrate  their  readiness.  The  US  conducted  a  va¬ 
riety  of  visible  activities  to  include  large-scale,  force-wide  exercises  and  small-scale,  local  exer¬ 
cises  to  demonstrate  its  capabilities.  And  the  United  States  messaged  its  competitors  and  friends 
through  use  of  declaratory  strategies  (which  did  not  always  match  the  actually  implemented 
strategies),  public  and  private  diplomacy,  international  conferences,  and  the  media.  Although  it 
is  difficult  to  assess  the  effectiveness  of  individual  elements  of  the  Cold  War  strategy  and  poli¬ 
cies,  it  is  clear  that  nuclear  weapons  were  not  used  during  the  Cold  War,  and  the  United  States 
did  not  fight  a  major  conventional  conflict  with  the  Soviet  Union  that  put  US  vital  national  inter¬ 
ests  at  risk.  This  suggests  that  there  might  be  utility  in  employing  a  parallel  operational  concept 
applied  to  cyber  deterrence;  however,  given  the  complexity  of  cyberdeterrence,  it  requires  a 
structured  process  which  can  be  aided  through  the  use  of  complex  multiple-actor  modeling. 

US  deterrence  strategy  was  effective  in  preventing  a  nuclear  exchange  during  the  Cold  War, 
but  this  same  strategy  had  another  benefit:  fear  that  one  side  might  employ  “tactical”  nuclear 
weapons  to  avoid  catastrophic  defeat  led  both  superpowers  to  avoid  a  major  conventional  war  in 
Central  Europe.^  Just  as  one  cannot  expect  cyberdeterrence  to  prevent  cyber  network  exploitation 
(CNE)  today.  Cold  War  deterrence  strategies  did  not  prevent  espionage  or  conflicts  involving 
proxies.  This  suggests  that  an  effective  cyberdeterrence  strategy  does  not  stand  alone,  but  serves 
as  an  element  of  a  comprehensive  defense  strategy.  Therefore,  deterrence  in  a  national  security 
sense  is  limited  to  behaviors  that  threaten  the  nation’s  vital  interests  such  as  attacks  on  indica¬ 
tions  and  warning  systems,  public  safety  and  health  systems,  homeland  defense  capabilities,  or 
national  financial  systems.  Complementary  defensive  actions  are  employed  to  protect  against 
other  detrimental,  but  less  onerous,  behaviors,  much  as  the  US  maintained  conventional  forces 
during  the  Cold  War  to  counter  attacks  against  global  interests  that  were  not  considered  vital  in 
nature. 


^  Note;  Although  the  effects  of  all  nuclear  weapons  are  strategic  in  nature,  weapons  that  were  employed  by  tac¬ 
tical  forces  were  called  “tactical”  nuclear  weapons  during  the  Cold  War. 
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Deterrence  fails  because  mutual  understanding  between  actors  is  lost,  or  one  actor’s 
cost/benefit  calculus  drives  an  unacceptable  behavior  despite  the  threat  of  punishment.  There¬ 
fore,  a  holistic  approach  to  deterrence  requires  the  US  to  identify  both  US  and  competitor  vital 
interests,  to  establish  a  robust,  open  dialogue  with  competitors  and  friends,  and  to  develop  and 
maintain  a  range  of  actions  to  maintain  the  stability  of  the  relationship.  This  naturally  leads  to  the 
development  of  strategies  designed  to  (1)  assure  friends  and  allies,  (2)  dissuade  adversaries  from 
developing  capabilities  that  threaten  national  well  being,  (3)  deter  potential  adversaries  by  en¬ 
couraging  restraint,  denying  benefits,  and  threatening  to  impose  unacceptable  cost,  and  (4)  main¬ 
tain  capabilities  to  terminate  conflict  at  the  lowest  level  of  destruction  consistent  with  strategic 
objectives.  Regardless  of  the  decision  maker,  deterrence  involves  four  primary  considerations: 

1 .  The  perceived  cost  of  restraint  (calculus:  costs  of  not  taking  an  action) 

2.  The  perceived  benefits  of  restraint  (calculus:  benefits  of  not  taking  an  action) 

3.  The  perceived  benefits  of  taking  action  (calculus:  will  action  achieve  the  desired  effect?) 

4.  The  perceived  costs  of  taking  action  (calculus:  how  will  the  competitor  respond?) 

Understanding  how  these  factors  are  interrelated  is  critically  important  to  determining  how 
best  to  influence  adversary  decision-making. 

Multi-modeling,  as  described  in  Chapters  1 1  and  12,  is  showing  great  promise  as  a  means  to 
represent  the  complex  interactions  among  the  many  actors  in  cyberspace  and  thus  support  ana¬ 
lysts  and  planners  as  they  develop  cyber  deterrence  strategies.  The  use  of  a  computational  infra¬ 
structure  and  systematic  workflow  provides  a  rigorous  basis  to  operate  various  models  accessing 
the  same  data  sets,  analyze  their  use  of  the  data  to  identify  ambiguities  and  omissions,  and  con¬ 
duct  coordinated  multinational  government  and  non-government  (Unified  Action"^)  course  of  ac¬ 
tion  development  and  evaluation. 

To  explore  the  use  of  deterrence  as  a  strategy  for  dealing  with  cyber  attack,  an  understanding 
of  the  political  and  military  use  of  nuclear  deterrence  during  the  Cold  War  will  be  informative, 
both  from  a  capabilities  and  a  limitations  perspective.  And,  to  get  a  better  perspective  of  how 
Cold  War  deterrence  concepts  might  apply  in  cyberspace,  it  is  also  useful  to  consider  the  differ¬ 
ences  between  the  Cold  War  strategy  for  deterring  employment  of  nuclear  weapons  and  today’s 
strategy  for  deterring  proliferation  of  weapons  of  mass  destruction. 

During  the  Cold  War,  the  United  States  faced  an  overwhelming  conventional  capability  from 
the  Soviet  Union  and  its  satellites,  and  therefore  felt  the  need  to  have  a  capability  to  maintain  a 
non-strategic  (tactical)  nuclear  capability  that  could  be  used  if  NATO’s  conventional  forces  were 
being  overrun.  An  elaborate  escalation  control  regime  was  established  on  both  sides  because 
there  was  a  fear  that  the  tactical  fight  in  the  central  plains  of  Europe  could  rapidly  escalate  into  a 
conflict  between  the  two  superpowers.  Promulgating  this  fear  was  intentional  on  the  part  of  the 
United  States,  particularly  during  the  period  when  the  Soviet  Union’s  conventional  force  capabil¬ 
ity  clearly  exceeded  NATO’s  conventional  forces  in  Europe.  So,  although  there  were  skirmishes 
between  these  two  great  powers  and  their  allies,  the  potential  for  use  of  tactical  nuclear  weapons 


Unified  action  synchronizes,  coordinates,  and/or  integrates  joint,  single-Service,  and  multinational  operations 
with  the  operations  of  other  USG  agencies,  NGOs,  and  IGOs  (e.g.,  UN),  and  the  private  sector  to  achieve  unity 
of  effort.  See  Joint  Publication  1 ;  Doctrine  for  Armed  Forces,  pg.  II-2. 
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effectively  deterred  a  conventional  conflict.  Although  there  was  a  clear  differentiation  between 
the  use  of  strategic  and  tactical  nuclear  weapons,  both  sides  believed  that  tactical  nuclear  weapon 
use  would  lead  to  strategic  nuclear  exchange.  Central  Europe  would  bear  the  cost  of  tactical  nuc¬ 
lear  weapon  use,  but  the  United  States  and  the  Soviet  Union  would  be  the  targets  of  a  strategic 
nuclear  exchange.  As  a  result,  first  use  of  nuclear  weapons  was  unlikely  unless  one  actor  be¬ 
came  convinced  that  its  vital  interests  were  threatened  and  believed  that  only  the  employment  of 
nuclear  weapons  would  prevent  the  stronger  power  from  imposing  its  will  on  the  lesser  power. 
This  key  element  of  the  Cold  War  deterrence  calculus  could  be  useful  in  formulating  approaches 
to  deter  cyber  attacks  that  threaten  United  States  vital  interests. 

Today’s  National  Security  Strategy^  places  great  emphasis  on  countering  the  proliferation  of 
technologies  which  would  enable  new  actors,  state  or  non-state,  to  develop  nuclear  weapons.  De¬ 
terrence  strategies  have  been  developed  to  help  counter  nuclear  proliferation,  but  these  strategies 
employ  significantly  different  levers  to  affect  the  relevant  actors’  decision  calculi.  Cold  War  nuc¬ 
lear  deterrence  was  largely  influenced  by  concerns  that  use  of  nuclear  weapons  by  either  side 
would  lead  to  a  strategic  nuclear  exchange  against  the  US  and  Soviet  homelands.  Deterring  the 
proliferation  of  WMD  technologies  is  grounded  in  the  Nuclear  Non-proliferation  Treaty,  with 
access  to  peaceful  uses  of  nuclear  energy  denied  to  proliferators.  But  another  deterrence  lever 
has  been  the  use  of  international  diplomacy  to  remind  potential  proliferators  and  their  supporters 
that  weapons  developed  from  their  proliferated  technology  could  also  be  used  against  them  in  the 
future.  It  is  difficult  to  prevent  a  country  from  proliferating  technology  for  purely  economic  or 
political  benefit;  nevertheless,  the  non-proliferation  regime  establishes  a  framework  which 
enables  the  effective  use  of  integrated  deterrence,  defense,  and  international  legal  strategies.  Si¬ 
milarly,  deterring  major  cyber  attacks  conducted  for  economic,  military,  or  political  purposes 
will  be  difficult,  but  an  international  regime  could  provide  a  framework  to  enable  effective  inter¬ 
national  cyberdeterrence  strategies. 

13.2  Deterrence  Operations  Joint  Operating  Concept 

The  Deterrence  Operation  Joint  Operating  Concept  (DO-JOC)^  outlines  a  basic  approach  to  de¬ 
terrence  and  was  a  first  attempt  to  apply  Cold  War  lessons  to  post-Cold  War  challenges. 
USSTRATCOM  has  evolved  this  concept  dramatically  over  the  last  three  years  and  is  in  the 
process  of  updating  the  2006  document.  The  DO-JOC  postulates  a  series  of  critical  assumptions 
for  effective  deterrence  of  adversarial  actions  and  behaviors  that  can  be  applied  to  cyber  deter¬ 
rence:  First,  the  United  States  is  aware  that  an  adversary  (state  or  non-state)  possesses  a  cyber 
attack  capability  that  threatens  its  vital  interests.  Second,  the  adversary  actions  to  be  deterred 
result  from  deliberate  and  intentional  calculations  regarding  alternative  courses  of  action  and 
their  perceptions  of  the  values  and  probabilities  of  alternative  outcomes  associated  with  those 
different  courses  of  action.  Finally,  cyber  deterrence  must  assume  that  at  least  some  adversary 
values  and  perceptions  relevant  to  their  decision-making  can  be  identified,  assessed,  and  influ¬ 
enced  by  others.  The  DO  JOC  goes  on  to  note  that  some  actors  (both  state  and  non-state)  will 
be  extremely  difficult  to  deter;  however,  truly  irrational  actors  are  extremely  rare.’  Their  calculus 
may  be  very  different  from  that  of  the  United  States  but  what  constitutes  rational  behavior  must 


^  National  Security  Strategy  of  the  United  States,  2006. 

®  Deterrence  Operation  Joint  Operating  Concept,  Version  2.0,  Department  of  Defense,  2006  (Available  at 
www.dtic.mil/futurejointwarfare) 

’  Ibid,  pg.  11. 
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be  understood  in  their  terms.  The  following  examination  of  cyberdeterrence  accepts  these  fun¬ 
damental  assumptions  and  focuses  on  deterring  rational  actors  from  attacking  US  vital  interests 
in  or  through  cyberspace. 

When  most  people  think  of  deterrence,  the  first  thought  that  comes  to  their  minds  is  the  abili¬ 
ty  to  impose  significant  punishment  in  retaliation  for  an  attack.  However,  the  Deterrence  Opera¬ 
tions  JOC  suggests  that  adversaries  can  also  be  deterred  if  they  feel  their  actions  will  not  achieve 
the  desired  benefits  (denial)  or  that  restraint  from  the  action  will  achieve  a  better  outcome  than 
taking  the  action  the  US  seeks  to  deter.^  This  brings  us  back  to  the  concept  of  extended  deter¬ 
rence  experienced  during  the  Cold  War:  The  stronger  power  was  deterred  from  using  its  over¬ 
whelming  conventional  capability  to  defeat  the  weaker  power  because  the  weaker  power  could 
employ  its  nuclear  weapons  to  deny  the  objectives  of  the  stronger  power’s  attacks.  In  the  context 
of  non-proliferation  there  is  another  form  of  “extended  deterrence”  where  the  US  offers  to  “ex¬ 
tend”  its  nuclear  deterrent  force  to  protect  US  allies  provided  they  eschew  development  of  their 
own  nuclear  weapon  capabilities.  For  most  of  these  countries,  the  US  commitment  to  protect 
them  from  nuclear  attack  greatly  simplifies  their  cost/benefit  calculus  regarding  the  need  to  de¬ 
velop  their  own  nuclear  weapon  capability. 

One  of  the  lessons  we  can  take  from  the  Cold  War  experience  is  the  tremendous  value  of 
asymmetric  weapons  to  a  power  that  is  less  capable  of  conventional  warfare,  particularly  when 
these  powerful  weapons  can  be  obtained  at  relatively  little  cost.  Interestingly,  when  viewed  from 
the  adversary’s  perspective,  the  acquisition  of  these  capabilities  may  be  intended  to  serve  as  a 
deterrent  to  actions  and  behaviors  by  the  United  States.  We  also  see  that  while  the  ability  to  im¬ 
pose  great  punishment  is  a  key  aspect  of  deterrence,  there  are  also  aspects  of  deterrence  which 
flow  from  the  ability  to  encourage  restraint  and  deny  the  benefits  of  adversary  actions.  With  the 
end  of  Cold  War,  and  the  emergence  of  new  nuclear  powers,  the  United  States  recognized  that 
the  traditional  Cold  War  approaches  to  deterrence  might  not  be  effective.  Now,  with  the  advent 
of  national  missile  defense,  the  United  States  possesses  the  capability  to  defend  the  homeland 
from  a  limited  missile  attack,  and  since  it  can  use  non-strategic  weapons  to  deter  less  capable 
potential  adversaries  of  our  friends  and  allies  without  fear  of  a  retaliatory  attack  on  the  US  ho¬ 
meland,  the  credibility  of  US  extended  deterrence  is  enhanced. 

13.3  Enabling  Deterrence 

It  will  be  instructive  to  assess  how  the  DO  JOC  applies  to  cyberdeterrence.  With  credit  to  Gen¬ 
eral  Larry  Welch,  cyber  deterrence  is  difficult  unless  we  first  understand  our  critical  vulnerabili¬ 
ties  and  take  action  to  protect  them^.  Another  important  concept  can  be  found  in  a  2008  AFSAB 
report'*^  which  argued  that  it  is  important  to  protect  the  United  States  from  the  effects  of  attacks 
rather  than  just  protect  the  targets  of  the  attacks.  One  might  think  of  this  protection  against  ef¬ 
fects  as  “mission  assurance”  or  “cyber  resiliency”  as  contrasted  with  traditional  “information  as¬ 
surance”  which  focuses  on  the  protection  of  networks  and  systems.  From  a  deterrence  perspec¬ 
tive,  the  idea  is  to  introduce  uncertainty  in  the  adversary’s  mind  that  the  attacks  will  achieve  the 
desired  effects;  if  they  don’t,  and  there  is  a  possibility  that  the  source  of  the  attack  might  be  de¬ 
termined  through  forensic  analysis  or  intelligence  means,  this  potential  denial  of  benefit  should 


«  Ibid.,  pg.  5 

^  Welch,  General  Larry,  presentation  to  Cyber  Warfare  2008,  London,  U.K.,  March  31,  2008. 

Defending  and  Operating  in  a  Contested  Cyber  Domain,  Air  Force  Scientific  Advisory  Board,  DTIC,  2008. 
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affect  the  adversary’s  decision  calculus.  The  potential  for  attribution  can  be  improved  by  “reduc¬ 
ing  the  noise  level”  through  improved  security  and  defense  of  critical  information,  systems,  net¬ 
works,  and  infrastructure,  making  it  easier  to  detect  behaviors  that  might  pose  a  threat  to  the 
United  States.  This  could  include  establishment  of  protocols  and  standards  that  govern  both  the 
public  and  private  sectors  in  areas  that  could  affect  United  States  vital  interests.  Daniel  Geer 
recently  addressed  the  need  for  policy  choices  that  support  risk  management  versus  risk  avoid¬ 
ance,  clearly  recognizing  that  our  current  risk  avoidance  approach  to  cyberspace  is  attractive,  but 
impractical.  He  postulates  that  Americans  want  freedom,  security,  and  convenience,  but  they 
can  only  have  two.”  The  Nation  must  make  choices  to  implement  a  cyberdeterrence  strategy; 
anything  that  sacrifices  vitally  important  aspects  of  national  and  economic  security  in  cyberspace 
for  purposes  of  convenience  simplifies  the  attack  problem  for  a  cyber  adversary. 

One  of  the  benefits  of  multi-modeling  is  the  requirement  to  capture  subject  matter  expert 
(SME)  knowledge  in  a  systematic  manner  for  expression  in  an  appropriate  modeling  language, 
especially  in  situations  that  involve  multiple  actors.  The  discipline  of  workflow  use  has  been 
found  useful  for  information  sharing  among  subject  matter  experts,  and  it  is  critical  for  the  suc¬ 
cess  of  complex  analyses  involving  multiple  actors,  perspectives,  behaviors,  and  capabilities. 
One  of  the  current  experiments  to  evaluate  the  basic  research  conducted  thus  far  involves  analy¬ 
sis  of  alternatives  to  control  escalation  that  could  lead  to  WMD  use  involving  two  countries  with 
which  the  United  States  maintains  friendly  relationships,  India  and  Pakistan  (Chapter  14).  One  of 
the  challenges  for  the  United  States  is  that  one  country  is  assigned  to  the  US  Pacific  Command, 
and  the  other  is  assigned  to  US  Central  Command,  and  so  the  analysts  and  commanders  operate 
with  different  models  and  perceptions,  and  although  centrally  sourced,  with  different  intelli¬ 
gence.  The  use  of  multi-modeling  allows  central  decision  makers  to  better  understand  the  inter¬ 
relationships  and  differences  in  perspectives  that  exist.  The  models  do  not  make  decisions,  but 
provide  information  that  can  aid  the  analyst  to  assess  different  courses  of  action  for  the  consider¬ 
ation  of  the  decision  maker.  The  Pythia  timed  influence  network  application  uses  conditional 
probabilities  established  through  subject  matter  expert  analysis  to  allow  course  of  action  assess¬ 
ments.  Since  the  models  are  integrated  through  the  C2WT,  potential  actions  propagate  through 
all  actor  models  to  highlight  potential  second  and  third  order  (and  beyond)  consequences. 

13.4  Conclusion 

Research  into  the  use  of  structured  analytical  approaches  to  modeling  human  adversary  beha¬ 
viors  suggests  that  it  is  possible  to  gain  insights  into  the  strategies  of  state  actors  acting  in  an  ad¬ 
versarial  manner.  Although  additional  research  is  required,  it  appears  that  the  use  of  Bayesian 
influence  models,  informed  by  social  network  models,  can  be  used  to  evaluate  escalation  control 
measures  that  maintain  a  state  of  equilibrium  that  does  not  lead  to  major  conflict.  Furthermore, 
the  use  of  a  multi-lever  approach  to  deterrence  offers  a  path  to  an  integrated  strategy  that  not  on¬ 
ly  addresses  the  cost/benefit  calculus  of  the  primary  attacker,  but  also  provides  opportunities  to 
influence  the  calculus  of  mercenary  cyber  armies  for  hire,  patriotic  hackers,  or  other  such  groups. 
While  the  denial  and  punishment  approaches,  which  underpinned  Cold  War  deterrence,  may  not 
apply,  the  broader  approach  to  deterrence  described  in  the  US  Deterrence  Operations  Joint  Oper¬ 
ating  Concept,  which  emphasizes  the  cost/benefit  relationship  of  restraint  on  the  part  of  potential 


"  Daniel  E.  Geer,  Jr.,  Sc.D.,  "Cybersecurity  and  National  Policy,”  Harvard  National  Security  Journal,  vol.  1, 
April  7,  2010. 
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adversaries,  offers  a  sound  foundation  for  deterring  cyber  conflict  even  where  multiple  actors  are 
involved.  In  particular,  the  strategic  concepts  of  escalation  control  and  extended  deterrence 
which  developed  from  years  of  experience  with  nuclear  deterrence  are  applicable  and  relevant  to 
the  broader  concept  of  deterrence. 
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Chapter  14 


The  India-Pakistan  Crisis  Scenario 
The  GMU/CMU  MURI  Team 


14.1  Introduction 

In  this  chapter,  we  present  the  case  study  that  was  earried  out  to  provide  context  for  the  adver¬ 
sarial  and  multi-modeling  effort. 

The  scenario  is  fietitious  and  has  been  designed  to  serve  the  purposes  of  the  proposed  model¬ 
ing  research.  It  is  based  loosely  on  events  that  oecurred  between  India  and  Pakistan  in  June  of 
2002.  The  animosity  between  these  two  nations  has  its  roots  in  history  and  religion  and  is  epito¬ 
mized  by  the  long-running  confliet  over  the  state  of  Jammu  and  Kashmir  (J&K).  China  is  also 
administering  Aksai  Chin  at  the  northeastern  corner  of  Jammu  and  Kashmir  -  a  situation  eon- 
tested  by  India.  In  this  seenario,  a  sequenee  of  terrorist  incidents  oceurs  in  Sri  Nagar,  the  capital 
of  Indian  administered  state  of  J&K,  and  along  the  Line  of  Control  (LOC)  separating  the  Pakis¬ 
tani  eontrolled  Northern  Areas  and  India  eontrolled  Jammu  and  Kashmir.  At  the  same  time,  there 
is  growing  instability  and  disaffeetion  with  the  government  in  Pakistan,  while  in  India  the  oppo¬ 
sition  parties  are  beeoming  stronger.  The  two  countries  start  making  a  series  of  esealating  moves 
(e.g.  reeall  diplomatie  staff,  move  troops  toward  the  LOC,  reposition  mobile  missile  batteries, 
and  there  is  aetivity  in  both  countries’  nuclear  weapon  faeilities)  while  events  (e.g.  bombings) 
continue  to  take  plaee  on  both  sides  of  the  LOC.  As  is  eommon  in  sueh  situations,  part  of  the  es¬ 
calation  is  due  to  lack  of  understanding  of  the  adversary’s  intent  (partial  knowledge  of  the  state  - 
only  some  of  the  kinetie  components  are  known,  such  as  troop  movements,  but  not  intent  and 
strategy). 

The  situation  alerts  the  US  Government  as  well  as  its  armed  forees.  Speeifically,  US  Central 
Command  (CENTCOM)  has  Pakistan  within  its  geographie  area  of  responsibility  (AOR),  while 
US  Paeific  Command  (PACOM)  has  India  within  its  geographie  AOR.  China  is  also  eoncerned 
because  of  the  danger  of  nuclear  exchanges  between  India  and  Pakistan.  The  United  Nations  and 
Russia  may  also  get  involved.  The  USA’s  and  international  community’s  objective  is  to  dis¬ 
suade/deter  the  two  adversaries  from  esealating  the  situation  into  a  nuelear  exchange  and  affeet  a 
rapid  de-escalation  of  the  erisis.  It  has  been  observed  that  in  sueh  crises,  misinformation  about 
the  intent  of  the  adversary  and  misinterpretation  of  the  moves  an  adversary  makes  (quite  often  in 
response  to  domestie  pressures)  tend  to  escalate  the  crisis.  Consequently,  the  US  develops  an  In¬ 
telligence,  Surveillanee,  and  Reconnaissanee  (ISR)  plan  to  keep  its  leaders  informed.  This  is 
complemented  with  a  coordinated  information  operations  eampaign  in  whieh  the  US  provides 
improved  information  about  the  state  of  the  conflict,  thus  reducing  the  ambiguities  about  the  sys¬ 
tem  state,  to  the  two  adversaries:  CENTCOM  to  Pakistan  and  PACOM  to  India. 

The  purpose  of  this  scenario  is  to  provide  a  basis  for  demonstrating  the  usefulness  and  effec¬ 
tiveness  in  using  multiple  models  together  to  assess  an  evolving  situation  and  develop  appropri¬ 
ate  eourses  of  aetion  (COA).  As  mentioned,  the  scenario  is  based  on  fictitious  events  that  oc¬ 
curred  in  the  summer  of  2002  between  India  and  Pakistan.  These  events  are  inspired  by  similar 
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real  incidents  that  have  taken  place  in  or  between  the  two  countries  as  part  of  the  long-running 
dispute  between  them.  While  the  events  are  fictitious,  the  actual  government  structures  and  the 
real  names  of  the  government  officials  of  the  two  countries  at  that  time  have  been  used.  The  ac¬ 
tions  and/or  statements  attributed  to  the  government  officials,  however,  are  fictitious.  The  same 
considerations  applied  in  modeling  the  US  involvement  in  its  attempt  first  to  stabilize  the  situa¬ 
tion  and  then  to  de-escalate  it.  Two  US  regional  commands  are  involved:  CENTCOM  and 
PACOM.  As  the  situation  escalates,  all  instruments  of  national  power  become  involved.  The  in¬ 
struments  of  US  national  power  are  known  as  DIME:  Diplomatic;  Information;  Military;  Eco¬ 
nomic. 

In  this  scenario,  we  consider  a  period  from  June  1 ,  2002  to  July  20,  2002  and  we  consider 
within  it  two  short  duration  vignettes  for  the  CENTCOM  and  PACOM  analysis  and  assessment 
of  the  situation  (see  Fig.  14.1). 


06/02/2002 


Vignette  A 


07/20/2002 

[06/30/2002  07/05/2002] 

Vignette  B 


Fig.  14.1  Scenario  timeline 

The  first  vignette  (A)  addresses  CENTCOM’s  and  PACOM’s  observation  of  the  situation  nd 
the  diplomatic  and  military  maneuvers  by  India  and  Pakistan.  Each  command  has  a  collection  of 
contingency  plans  (CONPLAN)  for  their  geographic  AOR.  This  situation  would  cause  both 
commands  to  more  closely  observe  as  well  as  update  their  respective  CONPLANs  and  support¬ 
ing  models.  Each  command  would  also  develop  multiple  courses  of  action  (CO As)  that  are  fo¬ 
cused  on  broadly  defined  diplomatic  actions  and  on  surveillance  and  other  intelligence  activities. 

The  second  vignette  (B)  assumes  that  the  CO  As  of  vignette  A  have  not  produced  the  desired 
results  and  the  crisis  is  escalating.  CENTCOM  and  PACOM  assess  the  situation  and  develop 
courses  of  action  to  de-escalate  the  crisis. 

Table  14.1,  provides  details  of  the  scenario  events  and  the  two  vignettes  undertaken  by  the 
two  command  centers. 

14.2  Vignette  A:  Strategic  Deterrence/Regional  Stability  Ops 

Vignette  A  addresses  CENTCOM  and  PACOM  observation  of  the  situation  and  the  diplomatic 
and  military  maneuvers  by  India  and  Pakistan.  In  this  section  we  present  a  workflow,  comprised 
of  models  and  their  mutual  interoperations,  used  by  the  two  command  centers  in  assessing  the 
situation  and  in  developing  contingency  plans,  if  the  situation  were  to  escalate.  The  two  com¬ 
mands  develop  their  individual  courses  of  action  that  are  focused  on  broadly  defined  diplomatic 
actions  and  on  surveillance  and  other  intelligence  activities.  The  following  is  a  description  of  the 
workflow  used  by  the  two  commands  and  the  models  used  by  the  two. 
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TABLE  14.1  Scenario  and  Vignette  timeline 

•  06/02/2002  -  06/07/2002:  Contention  rises  on  the  Indian  part  of  Kashmir, 
o  Suicide  squad  assault  on  the  state  parliament  in  Srinagar,  India. 

o  Indian  government  {National  Security  Advisor)  blames  Pakistan  supported  militant  organizations  (Lashkar-e- 
Taiba)  for  the  attack. 

o  Indian  government  hands  {Director  General,  Defense  Intel  Agency)  out  a  list  of  twenty  suspects  to  Pakistan 
demanding  that  Pakistan  hand  them  over  to  India. 

o  Pakistani  government  {Minister  of  Foreign  Affairs)  claims  no  responsibility  and  refuses  knowledge  of  the 

suspects. 

o  Pakistani  government  {Minister  of  Foreign  Affairs)  asks  India  to  provide  evidence  of  involvement  of  Pakista¬ 

ni  nationals  in  the  incident  citing  an  agreement  reached  by  the  South  Asian  nations  for  the  extradition  of  crim¬ 
inals. 

o  Indian  border  security  forces  (BSF)  exchange  fire  with  gunmen  trying  to  cross  into  Kashmir  at  LOC. 
o  Exchange  of  fire  between  Pakistani  and  Indian  forces  at  LOC. 
o  Gunmen  killed  1 1  people  in  Hindu  dominated  village  of  Pogal. 
o  Villages  along  LOC  are  being  evacuated. 

o  Pakistan  accuses  Indian  security  forces  of  atrocities  against  Kashmiri  civilian  population 

•  06/08/2002: 

o  India  {Minister  of  External  Affairs)  threatens  to  break  diplomatic  ties  with  Pakistan, 

o  Pakistani  religious  {religious  party-  Jamaat-e-Islami )  and  nationalist  parties  {Nationalist  Party  -  Pakistan 
Peoples  Party  )stage  a  demonstration  outside  Indian  embassy  in  Islamabad, 
o  India  issues  a  warning  to  all  its  citizens  travelling  in  Pakistan  to  plan  to  return. 

•  06/11/2002: 

o  Pakistan  recalls  non-essential  diplomatic  staff  from  India. 

o  Hindu  nationalist  parties  {Nationalist  Party  -  Shiv  Sena)  ask  Indian  government  to  take  punitive  actions 
against  terrorist  training  camps  operating  inside  Pakistan. 

•  06/12/2002:  India  recalls  non-essential  diplomatic  staff  from  Pakistan. 

•  06/02/2002  -06/12/2002:  CENTCOM  and  PACOM  observe  events  and  collect  intelligence. 

•  Vignette  A:  Strategic  Deterrence/Regional  Stability  Ops:  (Monitor  the  Situation;  diplomatic  actions) 

•  06/11/2002: 

o  PACOM  brings  up  models  (WebTAS,  CAESAR  III,  Pythia,  ORA), 
o  WebTAS  to  display  events 

o  CAESAR  III  model  of  Indian  Security  Council  to  identify  key  roles  and  relationships, 
o  ORA  model  of  Indian  Security  Council  and  diplomatic  contacts;  social  network  analysis  for  the  relevant  ele¬ 
ments  of  the  Indian  Government 

o  Pythia  to  model  possible  CO  As  for  surveillance  and  diplomatic  actions  for  de-escalating 

•  06/11/2002: 

o  CENTCOM  brings  up  models  (WebTAS,  CAESAR  III,  Pythia,  ORA), 
o  WebTAS  to  display  events 

o  CAESAR  III  model  of  Pakistani  Security  Council  to  identify  key  roles  and  relationships, 
o  ORA  model  of  Pakistani  Security  Council  and  diplomatic  contacts;  social  network  analysis  of  the  relevant 
elements  of  the  Pakistani  Government 

o  Pythia  to  model  possible  CO  As  for  surveillance  and  diplomatic  actions  for  de-escalating 

•  06/12/2002: 

o  PACOM  and  CENTCOM  Coordinate  surveillance  and  military/diplomatic  contact  CO  As 
o  Common  tasking  of  Space  assets 
o  Coordinated  tasking  of  RC-  135s 

o  Coordinated  message  to  diplomatic  and  military  contacts 

• 

•  End  of  Vignette  A 
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•  06/13/2002:  Use  space  assets  begin  tracking  the  designated  areas 

•  06/15/2002:  PACOM  and  CENTCOM  RC-135s  and  other  assets  are  collecting  data 

•  06/20/2002: 

o  Indian  heavy  troop  movement  along  the  border  (observed  by  Pakistan) 

o  India  increases  patrols  in  the  Batalik  sector,  deploys  heavy  artillery  regiment  supported  by  two  divisions  of 
the  Indian  army  and  paramilitary  forces  in  the  Kargil-Drass  sector, 
o  India  deploys  Mirage-2000  Hs,  radars  and  MiG-29  fighter  jets  along  the  western  border, 
o  More  specific  actions  observed  by  satellites  and  RC-135s  (visuals  here;  RC-135s  and  Google  Earth) 

•  06/23/2002: 

o  Indian  mobile  missile  batteries  movement  (US  data) 

o  Unusual  movement  observed  at  Kalpakkam  (South),  Jaipur  (West)  and  Patna  (East). 

•  06/28/2002: 

o  Pakistani  heavy  troop  movement  along  the  border  (observed  by  India) 

o  Movement  of  multiple  mechanized  artillery  divisions  observed  at  Sialkot  and  Rann  of  Kutch  sector. 

•  06/29/2002:  Diplomatic  movements  between  India  and  Russia;  US  aware 

•  Vignette  B:  Major  escalation  -  CO  A  development  for  regional  deterrence/crisis  de-escalation  ops. 

•  06/30/2002: 

o  Pakistan  equipment  movement  in  and  around  nuclear  facilities  (observed  by  US  assets) 
o  Movement  observed  at  Kahuta,  Khushab,  Chaghai  Hills  and  Wah. 

•  06/30/2002: 

o  CENTCOM  updates  models  (CAESAR  III,  Pythia,  ORA)  and  performs  new  course  of  action  analysis. 

•  06/30/2002: 

o  PACOM  updates  models  (CAESAR  III,  Pythia,  ORA)  and  performs  new  course  of  action  analysis. 

•  07/03/2002: 

o  India  equipment  movement  in  and  around  nuclear  facilities  (observed  by  US  assets), 
o  Movement  observed  at  Manuguru  (South)  and  Thai  Vaishet  (West).. 

•  07/03/2002: 

o  Indian  rhetoric  on  situation  heats  up 

o  Demonstration  by  Hindu  nationalist  parties  {Shiv  Sena,  Bhartiya  Janta  Party)  in  Delhi  and  other  major  cities 
burning  Pakistani  flags. 

o  Media  coverage  (News  Channels  of  India-  Doordarshan,  Star  News)  of  Indian  Pakistani  conflict  intensifies. 

•  07/03/2002: 

o  Pakistani  rhetoric  on  situation  heats  up 

o  Pakistani  religious  leadership  (leader  of  Jamaat-e-Islami  party)  calls  for  official  declaration  of  Jihad  against 
India. 

o  Media  coverage  {News  channel  of  Pakistan  -  GEO)  of  Indian  Pakistani  conflict  intensifies. 

•  07/04/2002:  PACOM  updates  CO  A 

•  07/04/2002:  CENTCOM  updates  CO  A 

•  07/05/2002: 

o  PACOM  and  CENTCOM  update  COA  analysis  and  develop  fused  COA  and  submit  to  JCS  and  SecDef 
(PMEESI) 

•  End  of  Vignette  B 
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14.3  Vignette  A  Workflow 


Figure  14.2  shows  the  workflow  used  in  the  development  of  courses  of  action  by  the  two  com¬ 
mands.  The  activities  in  the  workflow  can  be  divided  into  the  following  three  broad  steps:  (1) 
Identification  of  data  sources;  (2)  Development  of  models  using  the  extracted  information  from 
the  data  sources,  and  (3)  Analysis  using  the  models  to  identify  CO  As.  The  development  of  mod¬ 
els,  in  step  2,  requires  the  use  of  a  number  of  software  tools.  The  software  tools  used  in  the  vig¬ 
nette  are  listed  on  the  left-hand  side  of  Fig.  14.2.  Each  tool  is  aligned  horizontally  with  the  cor¬ 
responding  modeling  and  analysis  activities  in  the  workflow.  The  workflow  in  the  figure  also 
lists  activities  that  require  interoperation  and/or  comparison  of  two  or  more  types  of  models  in 
order  to  carry  out  the  refinement  and/or  analyses  on  the  models.  The  following  is  a  detailed  de¬ 
scription  of  the  data  sources  used,  models  constructed,  and  the  analyses  done  on  them  to  assess 
the  situation  between  India  and  Pakistan  in  the  context  of  the  scenario  of  Table  14.1  and  to  de¬ 
velop  some  courses  of  actions  to  diffuse  the  tensions  between  the  two  nations. 
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Fig.  14.2:  Vignette  A  workflow 


14.3.1  Data  Sources 

There  were,  in  general,  three  sets  of  data  the  researchers  used  to  support  this  effort:  scenario 
based  inputs  (listed  in  Table  14.1),  LexisNexis®-provided  data,  and  web-scraped  data  from  vari¬ 
ous  governments’  websites. 
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The  Carnegie  Mellon  University  (CMU)  researehers  used  LexisNexis®-provided  data  (ap¬ 
proximately  3,000  text  files  representing  stored  newspaper  artieles  meeting  the  seareh  eriteria)  as 
input  into  their  AutoMap™  tool.  The  selection  criteria  within  LexisNexis®  were  the  inclusive 
dates  of  the  scenario’s  vignettes  (20  Jun  -  5  Jul,  5  Jul  -  22  Jul)  and  the  words  “India”  and  “Pakis¬ 
tan.”  AutoMap™  is  a  semantic  extraction  tool  as  well  as  a  social  network  construction  tool.  Au- 
toMapT'^  takes  as  input  generally  unstructured  sources  (e.g.  newspaper  articles,  web  scrapings), 
and  through  a  series  of  repeatable  transformations,  generates  concept  maps/networks,  named  ent¬ 
ities  reports,  as  well  as  DyNetML^'^  files  for  use  by  Organizational  Risk  Assessment  (ORA)^'^. 
The  concept  maps  represent  the  semantic  distance  and  links  between  words  in  the  input  corpus 
[105]  and  helps  researches  identity  which  node  set(s)  individual  concepts  may  belong  to.  The 
DyNetML^M  files  are  XML  files  that  represent  the  nodes  (i.e.  agents,  organizations,  locations, 
knowledge,  beliefs,  resources,  roles,  and  tasks)  and  links  in  the  dynamic  social  networks  [106], 
[107]. 

The  researchers  decided  a  good  source  for  organizational  structure  data  for  each  nation’s  na¬ 
tional  security  apparatus  (their  equivalents  to  the  US  National  Security  Council,  Department  of 
Defense,  and  Department  of  State)  would  be  the  official  government  web  sites  of  Pakistan  and 
India,  including  their  separately  hosted  Ministry  of  Defense  web  sites.  Additionally,  to  gain  a 
better  understanding  of  how  those  countries  interact  with  the  US,  researchers  web  scraped  the 
official  web  sites  of  the  US  Central  Command  (USCENTCOM)  and  US  Pacific  Command 
(USPACOM).  The  US  uses  these  two  geographic  combatant  commands  to  execute  the  military 
and  some  portions  of  diplomatic  instruments  of  national  power.  After  these  web  scraps,  CMU 
had  approximately  27,000  text  files  to  input  into  AutoMap^'^. 

14.3.2  Social  Networks 

The  construction  of  the  social  network  was  an  iterative  process  not  completely  depicted  in  Fig. 
14.2.  There  was  very  tight,  though  manual,  coupling  between  CAESAR  III  AutoMap^M,  and 
ORA™  to  ensure  adequate  overlap  in  the  real-world  and  scenario-based  population.  The  manual 
coupling  also  ensured  correct  linkages  of  the  command  and  control  structures  and  agents  in  Pa¬ 
kistan,  India,  and  the  United  States.  There  was  also  tight,  though  still  manual,  coupling  between 
Pythia™  and  Construct™,  with  parallel  coupling  between  Pythia^i^,  AutoMap^'^  and  ORA^'^  to 
ensure  adequate  overlap  in  real-world  and  scenario-based  locations  and  events. 

The  CMU  and  George  Mason  University  (GMU)  researchers  used  the  AutoMap'^'^  generated 
networks  as  direct  inputs  into  ORA.  Through  a  series  of  human-to-human  inter-changes,  we 
identified  that  the  LexisNexis®  data  had  insufficient  overlap  with  the  Subject  Matter  Expert 
(SME)-generated  CAESAR  III  models  built  by  GMU — it  was  missing  Pakistan’s  Inter-Service 
Intelligence  (ISI)  agency,  the  Director  General  of  the  ISI,  India’s  Defense  Secretary,  US  Comba¬ 
tant  Commands,  and  the  US  Department  of  State.  Correcting  the  underlap  was  primarily  through 
modification  of  AutoMap’s'^'^  processing  rules  and  various  thesauri — ensuring  key  agents  did  not 
get  deleted,  that  sensitivity  thresholds  were  raised  or  lowered,  adding  entries  to  thesauri  to  conso¬ 
lidate  like-concepts. 

Two  separate  social  networks  for  each  country  were  built  from  the  CENTCOM  and  PACOM 
perspectives.  The  two  networks  were  a  quasi-hierarchy  with  the  national  security  council  (NSC) 
agents  in  one  network,  the  NSC-agents  plus  diplomats  relevant  to  that  COCOM’s  perspective.  A 
third  network  was  built  that  merged  the  network  models  from  each  COCOM,  keeping  the  agents 
from  the  NSC  and  diplomat  networks  and  all  remaining  agents  relevant  to  the  scenario  at  hand 
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(we  deleted  a  great  number  of  crieket  and  soecer  stars,  Bollywood  stars,  and  other  notables  found 
in  the  web  scrapings  that  were  functionally  irrelevant  to  the  scenario). 

Tables  14.2,  14.3,  and  14.4  summarize  the  node  types,  counts,  and  links  between  nodes  from 
each  US  geographic  combatant  command’s  perspective. 


TABLE  14.2  Vignette  A,  National  Security  Council  only,  CENTCOM  &  PACOM 


Node  Sets 

CENTCOM 

(Pakistan) 

PACOM 

(India) 

Agents 

27 

42 

Belief'^ 

21 

21 

Event 

40 

40 

Knowledge 

145 

145 

Location 

3250 

3250 

Organization 

321 

321 

Resource 

116 

116 

Role 

247 

247 

Task 

418 

418 

TABLE  14.3  Vignette  A,  NSC  and  diplomats  only,  CENTCOM  &  PACOM 


Node  Sets 

CENTCOM 

(Pakistan) 

PACOM 

(India) 

Agents 

47 

93 

Belief  through  Task*^ 

See  Table  14.1 

See  Table  14.1 

TABLE  14.4  Vignette  A,  all  agents,  CENTCOM  &  PACOM 


Node  Sets 

CENTCOM  (Pakistan)  &  PACOM  (India) 

Agents 

93 

Belief  through  Task’^ 

See  Table  14.1Error!  Reference  source 
not  found. 

Researchers  spent  the  preponderance  of  their  time  scrubbing  the  agent  node  set.  As  a  function  of  how  the  data 
was  collected  and  scrubbed,  the  node  counts  in  each  of  the  other  node  sets  are  usually  identical.  This  would  be 
unlikely  in  a  set  of  models  maintained  by  groups  of  staff  members  separated  by  thousands  of  miles. 
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CMU  then  used  ORA^m  to  visualize  and  analyze  the  dynamie  social  networks  built  through 
AutoMap’sT'^  text  and  semantic  analysis.  More  precisely,  the  focus  was  on  a  small  set  of  meas¬ 
ures  to  help  inform  the  development  of  the  other  models  as  well  as  help  refine  the  suggested 
courses  of  action.  Initial  analysis  was  through  the  use  of  Sphere  of  Influence  reports  (see  Figs. 
14.3  -  14.7),  run  manually  on  each  actor.  With  this  information,  as  well  as  betweeness-centrality, 
and  other  ‘Key  Entities’  reports,  researchers  further  ‘cleaned’  the  model  of  links  and  nodes  not 
immediately  relevant  to  the  purposes  of  the  research  (e.g.  numerous  concepts  and  agents  related 
to  the  sport  cricket,  persons  of  interest  in  the  US  Global  War  on  Terrorism  not  related  to  the  sce¬ 
nario,  historical  personages).  Researchers  maintained  records  of  this  additional  cleaning  to  allow 
better  automation  through  AutoMap™  in  follow-on  and  future  efforts.  These  reporting  metrics 
revealed  a  consistent  and  previously  unidentified  agent  with  prominent  roles  in  Indian  national 
decision  making — the  Indian  Deputy  Prime  Minister.  The  researchers  then  updated  the  CAESAR 
III  model  to  reflect  this  previously  missing  agent. 
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Fig.  14.3  Sphere  of  Influenee  Graphie  for  Indian  Foreign  Minister  during  Vignette  A’s  time  pe¬ 
riod.  Note  the  presenee  of  Deputy  Prime  Minister  Advani,  who  was  not  in  the  first  iteration  of 

Pythia  and  CAESAR  III  models. 
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Fig.  14.4  Sphere  of  Influence  Graphic  for  Pakistani  National  Security  Advisor,  for  all  time  pe¬ 
riods.  There  was  complete  overlap  between  CAESAR  III  and  Pythia  models  with  this  model 

built  through  AutoMap  and  ORA. 


Fig.  14.5  Sphere  of  Influence  Graphic  for  Indian  Prime  Minister  during  Vignette  A 
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powered  by  ORA,  CASOS  Center  CMU 

Fig.  14.6  Sphere  of  Influence  Graphic  for  Indian  Prime  Minister  during  Vignette  B 


Fig.  14.7  Sphere  of  Influence  Graphic  for  Indian  Prime  Minister  during  Vignette  C 


14.3.3  Construct  Model 

Construct,  based  on  Constructuralism  theory  [108],  [109],  is  a  turn  and  agent-based  simulation 
that  allows  agents  to  possess  and  transmit  knowledge,  forget  knowledge,  perform  tasks  (and 
learn  from  those  tasks),  and  acquire  (potentially  incorrect)  meta-knowledge  about  the  capabilities 
and  information  of  other  agents  in  the  simulation.  A  turn-based  simulation  is  one  in  which  every 
actor  is  given  the  opportunity  to  take  a  fixed  number  of  actions,  when  every  agent  has  acted,  a 
new  ‘turn’  begins.  Actor  order  is  usually  fixed.  Board-games  such  as  Monopoly,  Risk,  and 
Chess  can  be  thought  of  as  turn-based  ‘simulations’.  Agents  in  Construct  tend  to  interact  on  the 
basis  of  homophily  (a  preference  for  interacting  with  other  agents  that  share  similar  perceived 
traits),  but  may  also  seek  out  expertise  (a  preference  to  interact  with  agents  who  are  perceived  to 
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have  a  unique  or  rare  knowledge).  Construct  agents  are  not  required  to  navigate  a  virtual- world, 
although  an  abstraction  of  physical  proximity  can  be  used  to  influence  the  probability  of  agents 
interacting  with  others. 

For  Vignette  A,  CMU  modeled  Indian  and  Pakistani  decision  makers  as  Construct  agents. 
Each  of  the  provocations  (as  shown  in  Error!  Reference  source  not  found.)  represented  a 
source  of  knowledge  that  contributed  to  a  pro-war  belief.  Agents  started  with  random  distribu¬ 
tions  of  both  pro-war  and  pro-peace  knowledge,  and  were  allowed  to  interact  (their  interactions 
were  constrained  by  the  found  social  network  built  and  later  refined  as  part  of  the  workflow). 
Additional  knowledge  bits  that  did  not  influence  pro-war  belief  were  used  to  provide  points  of 
contrast  for  similarity  measures.  At  various  points  through  the  time-course  simulation,  the  num¬ 
ber  of  agents  who  had  the  pro-war  belief  was  measured. 

In  Vignette  A,  the  objective  was  to  assess  the  impact  of  all  of  the  provocations  that  had  oc¬ 
curred  on  networks  of  Indian  and  Pakistani  decision-makers,  assuming  both  that  no  further  prov¬ 
ocations  were  made,  nor  any  effort  to  defuse  the  crisis.  As  such,  a  very  simple  experimental  de¬ 
sign,  as  shown  in  Table  14.5  was  used. 


TABLE  14.5  Construct  experimental  design.  Vignette  A 


Parameter 

Number  of  Values 

Values 

Agent  Networks 

2 

PACOM,  CENTCOM 

Responses 

1 

None 

Total  Knowledge  Facts 

1 

450 

Total  "Similarity"  Facts 

1 

300 

Total  "Pro  War"  Facts 

1 

50 

Total  "Pro  Peace"  Facts 

1 

100 

Using  this  experimental  design,  the  following  two  experimental  conditions  were  used  for  one 
hundred  trials.  Figure  14.8  shows  the  results.  The  conclusion  from  this  chart  is  that  though  ten¬ 
sions  that  occur  throughout  the  first  ten  days  raise  tensions  between  the  two  countries,  they  do 
not  present  a  clear  demand  for  immediate  action  to  defuse  the  situation. 


Fig.  14.8  The  base  case  presented  from  Vignette  A.  We  model  only  those  tensions  that  occur  in 

the  first  ten  days. 
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14.3.4  Organizational  Models 

CAESAR  III  is  a  software  application  used  for  designing  information  processing  and  decision 
making  organizations.  CAESAR  III  is  developed  at  GMU.  Its  design  view  lets  a  user  design  an 
organization  by  creating  decision  makers  and  defining  interactions  among  them  and  with  the  ex¬ 
ternal  environment  in  terms  of  soft  and  hard  constraints.  It  uses  organization  theory,  imple¬ 
mented  in  the  Lattice  algorithm  [52],  [110],  to  generate  a  solution  space  that  contains  all  feasible 
organization  structures  satisfying  the  constraints.  The  organization  solution  space  is  bounded  by 
maximally  connected  and  minimally  connected  organizations.  Each  organization  structure  in  the 
solution  space  is  represented  in  the  form  of  a  Colored  Petri  net.  CAESAR  III  also  takes  into  ac¬ 
count  the  cultural  constraints  [73],  if  provided  by  the  designer,  within  an  organization. 

Two  separate  organization  models  for  each  country  were  built  from  the  CENTCOM  and 
PACOM  perspectives.  The  two  organizations  represent  the  National  Security  Council  (NSC) 
structure  of  the  two  countries’  governments.  In  a  further  refinement,  diplomats  relevant  to  the 
two  commands’  perspective  were  also  added  to  two  NSC  structures  of  the  two  countries. 

The  construction  of  the  organization  modes  was  also  an  iterative  process  not  completely  de¬ 
picted  in  Fig.  14.2.  The  initial  models  of  the  two  organizations  were  SMPE-generated  CAESAR 
III  modes  built  by  GMU.  The  ORA™  generated  social  network  and  analysis  results  were  com¬ 
pared  with  the  CAESAR  models  to  ensure  adequate  overlap  in  the  real-world  and  scenario-based 
population.  The  manual  coupling  also  ensured  correct  linkages  of  the  command  and  control 
structures  and  agents  in  Pakistan,  India,  and  the  United  States.  One  important  refinement  done  to 
the  PACOM’s  model  of  Indian  NSC  was  due  to  the  discovery  of  Indian  Deputy  PM  in  the  ORA 
sphere  of  influence  reports.  The  agent  was  overlooked  in  the  CAESAR  model  for  India. 


Fig.  14.9  Pakistani  Government  organization  model 
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Figure  14.9  shows  the  design  of  Pakistan’s  NSC  structure  in  CAESAR  III  developed  from 
the  CENTCOM’s  perspective.  Some  of  the  sources  that  were  manually  consulted  for  the  devel¬ 
opment  of  this  structure  are  listed  below: 

•  http://countrvstudies.us/pakistan/65.htm 

•  http://www.pak.gov.pk/structure  govemment.aspx 

The  structure  in  Fig.  14.9  depicts  the  Pakistan’s  NSC  as  a  graph  where  agents  (both  govern¬ 
ment  officials,  organizations,  foreign  diplomats),  considered  relevant  to  the  decision  making  for 
security  related  issues,  are  the  modeled  as  nodes.  In  this  figure  the  key  Pakistani  government 
official  and  their  interactions  are  shown  in  the  lower  half  and  the  primary  US  officials  that  can 
influence  those  Pakistani  government  officials  are  shown  at  the  top.  The  Ambassador  is  not  a 
CENTCOM  individual  but  he  works  closely  with  CENTCOM  .  These  individual  have  been 
called  U.S.  Levers  to  indicate  that  they  could  potentially  influence  key  individuals  within  the  Pa¬ 
kistani  government.  The  interactions  among  them  are  shown  as  links  between  them.  The 
CAESAR  III  design  approach  also  allows  a  designer  to  identify  the  type  of  interactions  that 
agents  use  to  communicate  with  each  other  in  an  organization.  A  class  of  interactions,  e.g., 
command,  information-sharing,  results-sharing,  etc.,  is  defined  to  express  the  types  of  interac¬ 
tions  that  can  exist  among  organization  members.  A  narrative  description  of  the  organization 
structure  in  Fig.  14.9  is  given  in  the  following  paragraph: 

The  President  is  the  Head  of  the  government.  He  gets  the  information  regarding  foreign 
issues  related  to  the  country  from  Minister  of  Foreign  Affairs  and  situation  assessment 
from  Prime  Minister.  ISI  chief  passes  his  intelligence  information  to  the  Defense  Minister 
of  Pakistan.  The  President  may  also  get  the  intelligence  information  from  ISI  chief.  Op¬ 
position  leader  advises  the  president  upon  internal  and  external  security  matters  of  the 
country.  The  President  discusses  his  overall  assessment  of  information  to  the  Defense 
Minister  and  Chief  of  General  Staff.  The  Chief  of  General  Staff  has  an  Intel  cell  that  in¬ 
dependently  assesses  the  situation  inside  and  outside  of  the  country  and  provides  him 
with  the  relevant  information. 

Figure  14.10  shows  the  design  of  India’s  NSC  structure  in  CAESAR  III  developed  from  the 
PACOM’s  perspective.  Again,  the  top  row  of  nodes  in  the  model  represents  the  US  levers  that 
have  contacts  (i.e.,  interaction)  with  one  or  more  actors  (DMs)  in  the  India’s  NSC.  Some  of  the 
sources  that  were  manually  consulted  for  the  development  of  this  structure  are  listed  below: 

•  http://countrvstudies.us/india/lQ9.htm 

•  http://www.nti.Org/e  research/profiles  pdfs/India 
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Fig.  14.10  Indian  Government  organization  model 


A  narrative  description  of  the  organization  structure  in  Fig.  14.10  is  given  in  the  following 
paragraph: 

The  Prime  Minister  is  the  Head  of  the  government.  President  is  the  Head  of  the  State  and 
acts  on  the  advises  of  the  Prime  Minister.  Chairman  Chief  of  Staff  Committee,  Home  Sec¬ 
retary,  Director  General  of  Defense  Intel  Agency  and  National  Security  Advisor  are 
members  of  the  National  Security  Council  (NSC). National  Security  Advisor  is  tasked  with 
regularly  advising  the  Prime  Minister  on  all  matters  relating  to  internal  and  external 
threats  to  the  country.  The  Opposition  Leader  is  supposed  to  give  suggestions  or  advises 
to  Prime  Minister  on  his/her  acts.  Defence  Secretary  and  Defence  Minister  are  part  of 
Indian  Defence  Ministry  which  is  charged  with  the  responsibility  of  internal  and  external 
security  of  the  country.  Minister  of  External  Affairs  is  most  concerned  with  foreign  affairs 
of  the  country.  The  minister ’s  duties  include  providing  timely  information  and  analysis  to 
the  prime  minister,  recommending  specific  measures  when  necessary  and  planning  policy 
for  the  future.  Deputy  Prime  Minister  seldom  carries  any  powers.  Generally,  a  person 
with  this  role  also  holds  key  positions  like  Minister  of  Home  Affairs  which  is  responsible 
for  matters  relating  to  internal  security  and  maintenance  of  law  and  order  within  the 
country. 
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14.3.5  Analysis  on  Organization  Models 


A  sphere  of  influence  analysis  was  performed  on  the  organization  models  of  the  two  countries’ 
NSC  structures  to  identify  the  actors  (DMs)  in  the  two  governments  that  can  be  directly  or  indi¬ 
rectly  (determined  by  the  organization  structure  and  the  type  of  interactions  involved)  influenced 
by  a  particular  US  lever.  For  example,  Fig.  14.611  represents  the  sphere  of  influence  of 
CENTCOM  J5  over  Pakistani  government  officials/units.  CENTCOM  J5  can  directly  interact 
with  “Minister  of  Foreign  Affairs”  of  Pakistan.  Furthermore,  his  influence  can  propagate  to  the 
President,  defense  Minister,  chief  of  general  Staff  and  ultimately  to  the  Army  because  of  the  in¬ 
teraction  links  among  these  entities.  The  levers  and  their  spheres  of  influences  for  the 
CENTCOM  and  PACOM  models  are  summarized  in  Table  14.6  and  Table  14.7,  respectively. 


TABLE  14.6  CENTCOM  sphere  of  influence  report 


L«'er 

laflueDced  DMs 

CENTCOM  Jii 

Mmistsr  of  Forsign  xAifairs  — ?  Presidait  — >  {Defsnss 
Mintsta:.  Chief  of  G-ensral  Staiff}  — s-  Army 

AmbassBdOT 

{Minister  of  Foreign  Affairs,  President  Prime  Minister} 

— ^  {Defense  Minister,  Chief  of  General  Staff}  — ^  Army 

Embassy  Officsr 

Opposition  Leader  — ^  President  ^  {Defense  Minister, 
Chief  of  General  Staff}  ^  Army 

CENTCOM  Command-sr 

{Defense  Minister^  Chief  of  General  Staff}  — ^  Army 

CENTCOM  J2 

ISI  Chief  — COGS  Intel  ^  {Defense  hlinister,  Chief  of 
General  Staff}  — ^  Army 
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TABLE  14.7  PACOM  sphere  of  influence  report 


hever 

iDflii^Dced  DMs 

Einba33y  OSlcer 

Opposition  Partj-  Leader  Prime  Kiinister  — ^ 

{President,  Chief  of  Army  Staff}  — Army 

PACOM  Commander 

{Chairman  Chiefs  of  Staff  Committee.  National  Securin' 
Ad^-tsor}  — ?  {Defense  Minister,  Director  General  DLA} 
—•■Defense  Secretary'  — ►  Minister  of  Home 

Affairs.  Depun' Prime  Minister  — »  Opposition  Parn' 

Leader  — ^  Prime  Minister  — ^■{President,  Chief  of  Army 
Staff}  — ^  Army 

Ambaissadof 

{Minister  of  External  Affairs,,  Prime  Minister, 

President}  — ►  {  Chief  of  Army  Staff,  Defense  Minister, 
Defense  Secretar^^  —*■  Army 

PACOM  J.5 

Defense  Minister  —i^{Prime  Minister,  President,  Chief  of 
Army  Staff,  Defense  Secretaiyr}  — i-  Army 

PACOM  J2 

Director  General  DIA National  Securin'  Ad^-isor— ► 
{Opposition  Parn' Leader,  Minister  of  Home 
Affairs.Depun^  Prime  Minister,  Prime  Minister}  — ^ 
{President,  Chief  of  Army  Staff}  ^  Army 

14.3.6  Situational  Assessment 

GMU  used  the  influence  net  modeling  tool,  Pythia,  in  concert  with  two  other  tools  (CAESAR  III 
and  Construct)  to  support  an  assessment  of  the  situation  and  course  of  action  analysis  in  support 
of  Vignette  A.  It  was  assumed  that  CENTCOM  and  PACOM  each  had  command  centers  with 
situation  analysis  cells.  This  section  discusses  Pythia  and  how  it  was  used  during  the  vignette. 

Pythia  is  a  Timed  Influence  Net  (TIN)  modeling  and  analysis  tool  [13],  [25],  [111],  [112]. 
With  it  one  can  create  models  of  situations  that  relate  Actions  or  Events  to  Effects  using  a  se¬ 
quence  of  causal  relationships.  Influence  nets  (IN)  are  static  (no  time)  and  Timed  Influence  nets 
incorporate  timing  information  that  enables  a  modeler  to  examine  the  effects  over  time  of  a 
timed  sequence  of  actions. 

The  models  consist  of  boxes  and  directed  relationships  (arrows).  The  boxes  represent  ran¬ 
dom  variables  that  are  associated  with  statements  that  can  be  true  or  false.  Typically  they 
represent  actions,  events,  and  effects  such  as  beliefs,  decisions,  and  other  actions.  An  arrow  that 
goes  from  a  parent  “box”  to  a  child  “box”  represents  a  causal  relationship.  In  Influence  Nets  the 
relationship  can  be  either  promoting  (if  the  parent  is  true  the  probability  child  will  increase)  or 
inhibiting  (a  true  parent  will  reduce  the  probability  of  the  child). 

In  creating  an  influence  net  a  modeler  creates  the  structure  of  the  net  and  then  incorporates 
the  “strengths”  of  the  various  influences.  The  modeler  can  also  specify  time  delays  associated 
with  the  arrows  (arcs)  and  the  boxes  that  have  parents.  Once  the  model  is  created,  various  ana¬ 
lyses  can  be  performed  with  it.  If  timing  information  is  not  include  then  the  Influence  net  can  be 
use  to  show  the  probability  that  the  effects  modeled  will  occur  given  a  set  of  actions  or  events.  If 
timing  information  is  included  in  the  model,  then  by  providing  the  probability  of  the  nodes  with 
no  parents  as  a  function  of  time,  probability  profiles  (probability  as  a  function  of  time)  will  be 
generated  for  each  node  that  has  parents. 

To  construct  and  use  a  TIN  to  support  course  of  action  (CO A)  analysis,  the  following  process 
has  been  defined. 
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1 .  Determine  the  set  of  desired  and  undesired  effects  expressing  each  as  declarative  state¬ 
ment  that  can  be  either  true  or  false.  For  selected  effects,  one  may  define  one  or  more 
observable  indicators  that  the  effect  has  or  has  not  occurred. 

2.  Build  an  IN  that  links,  through  cause  and  effect  relationships,  potential  actions  to  the  de¬ 
sired  and  undesired  effects.  Note  that  this  may  require  defining  additional  intermediate 
effects  and  their  indicators. 

3.  Use  the  IN  to  compare  different  sets  of  actions  in  terms  of  the  probability  of  achieving 
the  desired  effects  and  not  causing  the  undesired  effects. 

4.  Transform  the  IN  to  a  TIN  by  incorporating  temporal  information  about  the  time  the  po¬ 
tential  actions  will  occur  and  the  delays  associated  with  each  of  the  arcs  and  nodes. 

5.  Use  the  TIN  to  experiment  with  different  timings  for  the  actions  to  identify  the  “best” 
COA  based  on  the  probability  profiles  that  each  candidate  generates.  Determine  the  time 
windows  when  observation  assets  may  be  able  to  observe  key  indicators  so  that  assess¬ 
ment  of  progress  can  be  made  during  COA  execution. 

As  mentioned  earlier,  the  demonstration  was  based  on  two  vignettes  that  were  part  of  a  large 
scenario  in  which  tensions  were  escalating  between  India  and  Pakistan.  The  scenario  starts  with 
a  suicide  squad  assault  on  the  state  parliament  in  Srinagar,  India.  India  blames  Pakistan  and  Pa¬ 
kistan  claims  that  they  were  not  involved  in  the  attack.  A  serious  of  demonstrations,  riots,  de¬ 
mands,  and  diplomatic  posturing  occurs  in  both  countries  along  with  a  increase  in  military  activi¬ 
ty.  In  Vignette  A  PACOM  and  CENTCOM  each  use  a  set  of  models  created  on  June  12,  2002 
including  Pythia  to  assess  the  situation. 

Figure  14.12  shows  the  Pythia  model  that  was  created  for  CENTCOM. 


USAmbassador  stresses  needfbr 
restraint  and  US  commitment  to 
help  reduce  tensions  (0) 


CENTCOM  J5  meets  wth  MoFA  staff 
offer  non-mil  alternatives  to  military 
action  which  moFA  might  propose  (0) 


Pakistan  religious 
organizations  continue  to  hold 
violent  demonstrations  (0) 


Actions 

and 

Events 


India  continues  to  make 
accusations  about  Pakistan's 
role  in  attack  (0) 

US  Embassy  Pol-Mil  Officer  meets  with  PM  and 
opposition  leader  or  staffto  explain  potential 
adverse  consequences  of  escalation  (0) 

CENTCOMCommandermeets  with 
military  leadership  and  encourages 
constraint  (0) 

CENTCOMJ2  shares  US  assessments  that 
Pak  might  be  misinterpreting  situation 
and  outlining  escalation  danger 


Pakistan  observes  Indian 
movementof  military  resources 
near  border  (0) 


CENTCOM32  shares  US  assessments  that 
Pak  might  be  misinterpreting  situation 
and  outlining  escalation  danger  (0) 


Fig.  14.12  CENTOM  Pythia  model  for  Vignette  A 
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The  stracture  of  the  model  can  be  described  as  follows.  Two  main  overall  affects  of  concern 
are  shown  as  boxes  on  the  right  side  of  the  model.  These  effects  are  “Pakistani  Government  de¬ 
cides  to  take  pre-emptive  action”  and  “Pakistani  forces  move  positions.”  The  boxes  on  the  left 
hand  side  show  the  set  of  actions  that  CENTCOM  may  take  and  a  set  of  possible  Events  that 
could  happen  in  the  near  term.  The  possible  events  include  (a)  “Pakistan  religious  organizations 
continue  to  hold  violent  demos”,  (b)  “India  continues  to  make  accusations  about  Pakistan's  role 
in  attack”  and  (c)  “Pakistan  observes  Indian  movement  of  military  resources  near  the  border”. 
The  Action  nodes  include  a  set  of  lower  level  military-to-military  (US  CENTCOM  to  Pakistani 
counter  parts),  and  lower  level  diplomatic  discussions.  The  boxes  in  the  middle  represent  the 
potential  reactions  of  various  Pakistani  Government  Officials  to  the  events  and  actions  and  to  the 
reactions  of  each  other.  The  structure  of  this  model  was  created  using  the  CAESAR  organization 
model  as  shown  in  Fig.  14.10. 

A  key  notion  in  creating  the  Pythia  model  is  deciding  what  statements  should  be  included  in 
the  boxes.  Subject  matter  expertise  is  needed  to  determine  this.  The  statements  include  a  sum¬ 
mary  of  what  each  of  the  levers  will  say  or  do  and  what  the  expected  reaction  of  the  Pakistani 
government  official  might  be  given  the  parents  of  the  node  that  represents  their  reactions.  Ex¬ 
amples  of  the  types  of  action  are  “US  Ambassador  stresses  need  for  restraint  and  US  commit¬ 
ment  to  help  reduce  tensions”  and  “CENTCOM  J5  meets  with  MoFA  staff  to  offer  non-military 
alternatives  to  military  action  which  Minister  of  Foreign  Affairs  might  propose”.  An  example  of 
the  statements  indicating  possible  reactions  of  the  Pakistani  officials  are  “Minister  of  Foreign 
Affairs  thinks  Pakistan  should  take  a  strong  diplomatic  vice  military  stance”,  “Pakistan  Defense 
Minister  believes  defenses  must  be  increased”,  and  “Pakistani  President  believes  Pakistan  needs 
to  be  ready  to  escalate  if  India  moves  forces”. 

14.3.7  Assess  Situation  and  COA  Analysis 

There  are  many  combinations  of  actions  and  events  that  could  be  analyzed.  In  the  scenario  Vig¬ 
nette  two  cases  were  examined.  The  first  called  worse  case  was  based  on  all  provocative  events 
occurring  (e.g.,  violent  demonstrations,  Indian  government  accusations,  movement  of  Indian 
forces,  etc.).  In  a  second  analysis  Pakistan  does  not  observe  the  movement  of  Indian  forces.  The 
first  analysis  done  for  the  worse  case  was  a  COA  where  CENTCOM  and  the  US  take  no  action. 
Error!  Reference  source  not  found.Figure  14.13  shows  a  summary  of  the  results  of  this  analy¬ 
sis.  In  the  probability  profile  the  zero  point  on  the  horizontal  axis  represents  the  day  the  analysis 
was  done  in  the  scenario  (June  12,  2002). 

This  analysis  was  followed  by  a  series  of  analyses  to  evaluate  the  effects  of  COAs  that  in¬ 
clude  the  use  of  the  levers  and  their  timing.  This  was  done  in  two  steps.  First,  the  evolutionary 
search  algorithm  included  the  Pythia  suite  of  analysis  tools  was  used  to  provide  and  initial  set  of 
actions  and  timing  (a  COA).  The  results  are  shown  in  Fig.  14.14. 

Next,  the  timing  of  the  actions  provided  by  the  search  algorithm  was  adjusted  to  cause  the  ac¬ 
tions  to  be  taken  at  the  earliest  possible  time.  One  constraint  was  that  the  CENTCOM  Com¬ 
mander  should  meet  after  the  J2  and  J5  have  their  meetings.  This  resulted  in  a  slight  improve¬ 
ment  it  the  probability  profdes  of  the  key  effects  as  shown  in  Fig.  14.15. 


92 


Worst  Case 
With  No  US  Actions 

Pakistan  seems  unsure  as  to 
whether  to  continue  with  miiitary 
activity  at  the  moment 
Pakistani  anti  -india  reiigious 
demonstrations  reported  in  the 
media  couid  cause  india  to  consider 
preemptive  action  and  consider 
moving  miiitary  resources  in  about 
10-20  days. 

Pakistan’s  detection  of  indian 
movement  on  day  10  (6/21)  may 
cause  Pakistan  to  move  troops  on 
day  16  or  eariier  (6/27) 

Lack  of  dipiomatic  action  and  the 
Pakistani  observation  of  indian 
movement  couid  make  the  situation 
deteriorate  quickiy 


Fig.  14.13  Assessment  of  worse  ease  situation 
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Fig.  14.14  Assessment  using  Evolutionary  Search  algorithm 


93 


r  l^j-ob.^bilitY  For  CCMM  Ccntcam  Ifig  A  D^ZS^l 


0.0 

Jun  12 


f  <  6  ft  Ifli  i;  1*  IS  ^20  22 

TIME 

QovcfnfKTiie  dncKk-i  lo  tike  pf^Hinp^  -KJxn 
P^kifJxii  lcfC41:  rafl^ 


All  Provocations 


Worst  Case 

Adjusted  Possible  Actfons  and  Timing  - 

.  C  E  NTCOM  J  5  meets  jYjyj  ^  Jffl  <iay  2 
{0€/14y2002Hnsteadof  $(i|y  5  {06/17/2002  ; 

>  GENICOM  J2  shares  US  assessments  with 
Dir  [SI  an  slay  2  {06/i4/2002j  ins!!?a{l9f.tiay  3 
{06/15/2002} 

-  US  Embassy  £si(  Mi  I  Officer  meets  with  PM 
aM opposition  leader  {or  staff)  sm  Say  ^ 
{06/14/2002] 

'  U  S  Ambassador  stresses  need  for  restraint 
US  commitment  to  help  reduce  tensions 
Slay  2  (06/14/2002)  instead  of  day  0 
(06/21/2002) 
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Fig.  14.15  Improved  probability  profile  by  taking  actions  early 

An  analysis  was  done  using  the  same  actions  and  timing  for  the  analysis  shown  in  Fig.  14.15, 
but  without  the  Ambassador  actions.  This  was  done  to  examine  what  the  effect  would  be  if  the 
Ambassador  was  not  able  to  hold  his  meeting.  Note  that  it  is  the  call  of  the  US  Department  of 
State  to  direct  the  Ambassador  to  hold  such  a  meeting,  not  CENTCOM.  The  results  are  shown  in 
Fig.  14.16. 

Finally  an  analysis  was  done  to  see  the  impact  on  Pakistan  of  India  moving  its  forces.  Figure 
14.17  shows  the  results  when  Pakistan  does  not  observe  India  troop  movement.  The  results  of 
this  analysis  clearly  indicate  the  importance  of  trying  to  convince  India  to  use  restraint  in  its  ac¬ 
tions.  The  results  of  this  analysis  would  likely  be  discussed  with  CENTCOM’ s  counterparts  in 
PACOM.  CENTCOM  should  lobby  for  the  Ambassador  to  participate  in  the  course  of  action  in 
a  coordinated  way. 

Overall  the  assessment  is  that  the  situation  bears  considerable  watching  because  there  is  a 
reasonable  chance  the  situation  could  escalate  if  India  moves  forces.  Even  if  they  do  not  do  that, 
there  is  still  a  possibility  of  escalation. 

The  analysis  indicates  that  if  there  are  few  further  provocations  (particularly  provocative 
movements  of  forces  by  either  side),  the  situation  will  remain  tense  but  under  control.  However 
if  provocations  continue,  particularly  movement  of  forces,  then  tensions  will  escalate.  This  esca¬ 
lation  could  occur  within  12-20  days.  The  Pythia  analysis  suggests  using  all  lower  level  levers  as 
soon  as  possible  to  convince  the  Pakistani  principals  that  they  should  follow  non-military  courses 
of  action.  Both  military- to-military  and  the  US  Ambassador  to  his  counterparts  actions  should 
occur.  US  should  focus  Intelligence  Surveillance,  and  Reconnaissance  (ISR)  assets  on  possible 
movements  of  forces  (of  both  Pakistan  and  India)  as  well  as  incidents  such  as  riots,  demonstra¬ 
tions,  of  acts  of  violence  to  keep  the  levers  informed  of  true  situation. 
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Fig.  14.16:  No  Ambassador  involvement 
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Fig.  14.17:  Effect  of  India  not  moving  forces 
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A  similar  analysis  was  done  for  the  PACOM  perspective  on  India. 

Figure  14.18  shows  the  PACOM  Pythia  model,  and  Figs.  14.19,  14.20,  and  14.21,  show  the 
Worse  Case,  no  action  analysis  and  the  best  case  where  all  actions  are  taken  aggressively  and 
Pakistan  does  not  move  its  forces.  The  summary  for  India,  from  the  PACOM  perspective,  was 
similar  to  that  of  CENTCOM  for  Pakistan:  if  no  major  provocations  occur,  then  the  situation  will 
remain  stable.  However,  if  Pakistan  decides  to  move  her  forces  into  the  region  near  the  Line  of 
Control  this  could  cause  India  to  consider  strong  escalation.  Messages  by  all  levers  should  be 
coordinated  and  informed  by  ISR  to  ensure  consistent  messaging. 


Actions  and  Event 


Indian  Government  decides 
to  take  punitive  action 
(0.04) 


Fig.  14.18  PACOM  Pythia  model  situation 
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Worst  Case 
No  US  Action 

Pakistani  accusations  and 
demonstrations  start  to  cause 
india  to  consider  taking  punitive 
action  and  may  cause  her  to 
consider  moving  military 
resources  in  about  10  days. 

India  detection  of  Pakistan 
movement  on  day  10  (6/21) 
causes  India  to  potentially  move 
troops  on  day  16  or  earlier 
(6  days  later  (6/27)) 

Lack  of  diplomatic  action  and 
India’s  observation  of  Pakistani 
movement  makes  the  situation 
deteriorate  quickly 


Fig.  14.19  Probability  profile  for  India 


Fig.  14.20  PACOM  analysis  of  situation  with  all  actions 
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Fig.  14.21  PACOM  analysis  with  no  movement  of  Pakistani  forces 


14.4  Vignette  B:  Major  escalation:  COA  development  for  regional  deterrence/crisis  de- 
escalation  ops 

Vignette  B  assumes  that  the  CO  As  of  Vignette  A  have  not  produced  the  desired  results  and  the 
crisis  is  escalating.  As  part  of  this  vignette,  CENTCOM  and  PACOM  observe  the  new  develop¬ 
ments  in  their  areas  of  responsibility,  assess  the  situation,  and  develop  individual  courses  of  ac¬ 
tion  to  de-escalate  the  crisis.  The  two  commands  use  the  same  workflow  as  employed  in  Vignette 
A  (given  in  Fig.  14.2)  to  develop  their  individual  COAs;  however,  they  develop  new  models  and 
carry  out  new  analyses  in  view  of  the  events  taking  place  as  part  of  the  scenario.  Since  the  situa¬ 
tion  has  escalated  to  a  point  where  an  armed  conflict  between  the  two  nations  seems  eminent,  the 
two  commands  merge  their  models  for  a  combined  situation  assessment  and  develop  a  unified 
COA,  as  depicted  in  Fig.  14.22. 
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GENICOM  Workflow  (as  in  Fig.  14.2) 
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PACOM  Workflow  (as  in  Fig.  14.2) 


Fig.  14.22:  Vignette-B  workflow 


The  following  is  a  detailed  description  of  the  data  sources  used,  models  constructed,  and  the 
analyses  to  assess  the  situation  between  India  and  Pakistan  as  part  of  Vignette  B  activities  by  the 
two  commands  for  both  developing  their  individual  and  merged  COAs. 

14.4.1  Data  Sources 

The  data  sources  for  Vignette  B  were  identical  to  the  methods  listed  for  Vignette  A.  The  differ¬ 
ences  between  the  data  sets  were  in  two  of  the  three  data  sources:  the  scenario  event  list  and  the 
LexisNexis  data  pull.  The  LexisNexis  data  pull  was  for  the  inclusive  dates  of  the  vignettes,  driv¬ 
ing  few  minor  changes  in  the  network  structure.  The  scenario  event  list  was  also  different,  in 
both  the  events  listed  as  well  as  the  locations  of  those  events. 

The  summary  of  node  types  and  their  respective  quantities  are  provided  in  Tables  14.8,  14.9, 
and  14.10. 
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TABLE  14.8  Vignette  A,  National  Security  Council  only,  CENTCOM  &  PACOM 


Node  Sets 

CENTCOM 

(Pakistan) 

PACOM 

(India) 

Agents 

23 

42 

BeliefError! 
Bookmark  not 
defined. 

32 

32 

Event 

22 

22 

Knowledge 

148 

148 

Location 

3303 

3303 

Organization 

325 

325 

Resource 

117 

117 

Role 

244 

244 

Task 

424 

424 

TABLE  14.9  Vignette  B,  NSC  and  Diplomats  only,  CENTCOM  &  PACOM 


Node  Sets 

CENTCOM 

PACOM 

(Pakistan) 

(India) 

Agents 

47  India 

111 

Belief  through  Task 

See  Table  14.1 

See  Table  14.1 

TABLE  14.10  Vignette  B,  all  agents,  CENTCOM  &  PACOM 


Node  Sets 

CENTCOM  (Pakistan)  &  PACOM  (India) 

Agents 

111 

Belief  through  Task 

See  Table  14.1 

The  analysis  of  the  network  data  for  Vignette  B  did  not  reveal  any  missing  and  relevant  ac¬ 
tors  from  the  network  created  for  Vignette  A.  The  alignment  of  key  agents  is  likely  much  more  a 
function  of  how  the  researchers  collected  and  pruned  the  collected  data  than  may  be  realistic  to 
expect  in  a  real-world  environment.  As  in  Vignette  A,  Sphere  of  Influence  reports,  Betweenness 
Centrality,  as  well  as  Key  Entities  reports  were  used  by  researchers  to  ensure  tight  coupling  with 
the  CMU  &  GMU  tool  sets. 

14.4.1.1  Sample  Key  Entity  Reports  for  Vignette  B 

From  the  key  entity  reports,  as  well  as  reviews  of  key  entities  over  time,  researchers  built  a  set  of 
plausible  underlying  analysis.  The  overall  theme  of  these  reports,  using  the  prominence  and  fre¬ 
quency  of  presence  in  the  harvested  data,  is  that  US  diplomatic  circles  start  very  high  in  centrali¬ 
ty  and  influence.  There  is  a  downward  trend  reflected  in  the  concurrent  rise  in  influence  and  cen¬ 
trality  of  US  military  personages  (e.g.  Secretary  of  Defense,  Chairman  Joint  Chiefs  of  Staff). 
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Figures  14.23  and  14.24  are  the  Top  Ranked  leaders  histogram  from  the  Vignette  A  key  enti¬ 
ty  report.  Figure  14.23  is  from  a  CENTCOM  (Pakistan)  perspective,  while  Fig.  14.24  is  from  the 
PACOM  (India)  perspective.  They  show  the  Agents  that  are  repeatedly  top-ranked  in  the  meas¬ 
ures  listed  in  Table  14.11.  The  value  shown  is  the  percentage  of  measures  for  which  the  Agent 
was  ranked  in  the  top  three. 


Fig.  14.23  Top  ranked  leaders,  CENTCOM  perspective 


Fig.  14.24  Top  ranked  leaders,  PACOM  perspective 
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TABLE  14.11  Measures  reflected  in  Key  Entity  tables 


Acts  as  a  Hub  (hub  centrality) 

Leader  of  Strong  Clique  (eigenvector  centrality) 

Acts  as  an  Authority  (authority  centrality) 

Most  Knowledge  (row  degree  centrality) 

Complete  Exclusivity  -  event  (complete  ex¬ 
clusivity) 

Most  Resources  (row  degree  centrality) 

Complete  Exclusivity  -  knowledge  (complete 
exclusivity) 

Number  of  Cliques  (clique  count) 

Complete  Exclusivity  -  location  (complete 
exclusivity) 

Potentially  Influential  (betweenness  centrality) 

Complete  Exclusivity  -  resource  (complete 
exclusivity) 

Specialization  -  event  (relatively  unique) 

Complete  Exclusivity  -  task  (complete  exclu¬ 
sivity) 

Specialization  -  knowledge  (relatively  unique) 

Connects  Groups  (high  betweenness  and  low 
degree) 

Specialization  -  location  (relatively  unique) 

Emergent  Leader  (cognitive  demand) 

Specialization  -  resource  (relatively  unique) 

Group  Awareness  (shared  situation  aware¬ 
ness) 

Specialization  -  task  (relatively  unique) 

In-the-Know  (total  degree  centrality) 

Workload  (actual  based  on  knowledge  and  re¬ 
source) 

Figure  14.25  and  the  associated  table  reflect  the  agent  x  agent  network  of  Pakistani  and  US 
agents.  The  table  shows  the  top  ten  agents  in  potentially  influence  as  reflected  in  their  betwee- 
ness  centrality  score.  Betweeness  centrally  is  a  measure  that  reflects  how  often  a  particular  agent 
is  in  the  shortest  paths  between  all  pairs  of  agent  nodes  in  the  network.  These  agents  are  there¬ 
fore  good  to  use  to  quickly  pass  messages  to  and  from  other  agents  in  the  network.  The  relative 
importance  of  the  US  Chairman  of  the  Joint  Chiefs  of  Staff  is  likely  a  reflection  of  the  press’ 
coverage  of  the  US  high-level  military  interest  in  Pakistan  just  a  year  after  the  attacks  of  Sep¬ 
tember  11,  2001.  The  high  ranking  of  the  US  Ambassador  to  Pakistan  and  Secretary  of  State  are 
both  reflective  of  frequent,  and  subjectively  normal,  appearance  in  the  data  sources  given  a  rise 
in  international  tensions. 

Figure  4.26  and  the  associated  table  reflect  the  agent  x  agent  network  of  Indian  and  US 
agents.  Like  the  table  and  figure  for  CENTCOM  (Pakistan),  the  table  shows  the  top  ten  agents  in 
potentially  influence  as  reflected  in  their  betweeness  centrality  score.  The  relative  importance  of 
the  President  of  the  US  and  the  Secretary  of  State  reflect  their  frequent  mention  in  the  data 
sources.  Again,  the  subjective  evaluation  of  this  network  is  of  an  expected  network  given  the  be¬ 
ginnings  of  an  international  crisis. 
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Rank 


Agent 


pervet musharraf 


richardmyers 


george w bush 


donald  rumsfeld 


US a  m  ba  ssad  o  r pak 


colin powell 


comuspacom 


abdul  sattar 


tommy franks 


US^ambassadoMndia 


Fig.  14.25  Agent  x  Agent  network  of  Pakistani  and  US  agents 
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Fig.  14.26  Agent  x  Agent  network  of  Indian  and  US  agents 

Figure  14.27  (a  and  b),  from  a  CENTCOM  (Pakistan)  perspective,  reflect  CENTCOM’s 
awareness  that  Pakistan  is  very  aware  of  demonstrations  in  India,  while  at  the  same  time  Pakistan 
is  issuing  warnings  to  India  to  deescalate.  A  surprise  to  researchers  was  the  relative  importance 
of  US  actions  in  the  midst  of  the  rising  tensions.  This  was  our  first  indicator,  that  Construct  later 
substantiated,  that  US  military  actions,  even  as  innocuous  as  military  intelligence,  surveillance. 
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and  reconnaissance  flights,  could  inflame  passions  on  both  sides  of  the  border  crisis.  The  bottom 
figure  is  reflective  of  a  common  concern  for  military  and  security  related  knowledge,  but  more 
importantly,  eight  of  the  top  nine  top  concepts  of  knowledge  in  the  data  set  reflect  non- 
militaristic  concerns.  This  is  consistent  with  the  generalized  statement  that  there  are  always  many 
reasons  to  avoid  war. 


Fig.  14.27  CENTCOM  Perspective  of  the  situation 

Figure  14.28  (a  and  b)  reflect  the  PACOM  (India)  perspective.  Of  note  is  the  mutual  aware¬ 
ness  of  the  other  country’s  demonstrations  as  well  as  the  mutual  awareness  of  US  military  opera¬ 
tions.  There  is  another  interesting  observation  in  that  the  reports  are  not  identical  across  the  two 
combatant  command’s  perspectives.  Recall  that  the  researchers  had  scraped  common  data,  and 
spent  the  majority  of  time  ‘cleaning’  the  agent  networks  extracted  from  the  unstructured  text.  Yet 
despite  the  common  origins  of  the  data,  there  was  enough  unique  structure  in  each  meta-network 
to  derive  slightly  different  versions  of  key  events  and  knowledge. 

Sample  Key  Entity  Reports  for  Vignette  B 

With  distinct  time  periods  and  a  series  of  intervening  events,  there  is  an  apparent  need  to  com¬ 
pare  and  contrast  data-driven  network  measures.  The  most  striking  observation  for  the  top  ranked 
leader  figures  is  the  rising  importance  of  US  military  representatives  (Fig.  14.29).  This  is  not 
surprising  given  the  close  ties  the  US  has  attempted  to  forge  with  the  Pakistani’s  since  we  in¬ 
vaded  Afghanistan.  Also  given  those  close  ties,  it  is  not  surprising  to  see  the  Director  General  of 
the  ISI  prominently  figuring  across  the  metrics  listed  in  Section  14.3.2. 
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Fig.  14.28  PACOM  Perspective  of  the  situation 


Fig.  14.29  Relative  importance  of  top-ranked  leaders 

The  US  diplomatic  corps,  from  the  PACOM  (India)  perspective,  is  still  the  dominant  force 
when  engaging  with  Indian  national  decision  makers.  It  is  clear  however  that  the  level  of  authori¬ 
ty  being  brought  to  bear  is  significantly  higher,  as  he  Secretary  of  Defense  as  increased  to  the 
second  ranking  and  the  Secretary  of  State  has  risen  into  the  top  ten  while  his  deputy  dropped  four 
positions.  The  concurrent  decrease  in  importance  of  the  opposition  party  can  also  be  reflective  of 
a  hardening  Indian  viewpoint,  with  the  opposition  leader  no  longer  in  a  central  advisory  role  to 
the  Indian  Prime  Minister. 
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Rank 

Agent 

1 

pervez musharraf 

2 

donald rumsfeld 

3 

richard myers 

4 

george w bush  WT 

5 

cotin powel! 

6 

tonnmy franks 

7 

comuspacom 

8 

US_ambassador_pak|® 

9 

rao sikandar iqbaiiK 

10 

US ambassadorJndia 
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Fig.  14.30  Agent  x  Agent  network  of  US  and  Pakistani  agents 

As  noted  in  Vignette  A,  Fig.  14.30  and  associated  table  display  the  agent  x  agent  network  of 
US  and  Pakistani  agents  though  now  it  is  applicable  to  Vignette  B.  Note,  the  increased  promi¬ 
nence  of  the  Secretary  of  Defense  as  an  agent  high  in  betweeness  centrality  and  therefore  a  po¬ 
tentially  influential  agent. 


Rank 

1 

2 

3 

4  _ 

5  _ 

6  _ 

7  _ 

8  _ 

9 

10 


Agent 


ata  l_be  ha  ri_vaj  pay 


US  ambassador 


jaswant singh 


george w bush 


comuspacom 


colin powell 


donald  rumsfeld 


richard myers 


tommy franks 


sushil  kumar 


Fig.  14.3 1  Agent  x  Agent  Network  of  US  and  Indian  agents 
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Also  for  Vignette  B,  Fig.  14.31  and  the  associated  table  and  figure  reflect  the  changes  from 
the  PACOM  (India)  perspective.  Here,  we  see  that  the  relative  importance  of  the  Indian  Foreign 
Minister,  and  the  continued  presence  of  the  Secretary  of  State  can  be  an  indicator  that  military 
and  military-minded  agents  are  not  yet  dominating  the  Indian  viewpoint  in  this  crisis. 


Fig.  14.32  Key  events  from  the  CENTCOM  (Pakistan)  perspective 


As  Vignette  B  proceeds,  these  key  events  and  key  knowledge  figures  show  that  the  Indian 
Air  Forces  deployment  has  become  a  key  event  from  the  CENTCOM  (Pakistan)  perspective. 
Additionally,  even  though  military  related  knowledge  is  now  two  of  ten  top  knowledge  events, 
economics  is  still  frequently  mentioned  concern  in  the  data  sources.  (Fig.  14.32) 


Fig.  14.33  Key  Events  from  the  PACOM  (India)  perspective 
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The  figures  (Fig.  14.33)  from  the  PACOM  (India)  perspective  show  a  rising  awareness  of 
Pakistani  troop  movements.  Of  note,  is  the  scenario-based  warnings  by  the  Indian  government  to 
its  citizens  in  Pakistan  that  they  should  leave  Pakistan  for  their  own  safety.  US  ISR  flights  are 
still  in  the  top  seven  entries  for  key  events — reinforcing  the  idea  that  US  reconnaissance  activi¬ 
ties  may  actual  increase  tensions  between  the  two  countries. 


14.4.2  Construct  Model 

For  Vignette  B,  Indian  and  Pakistani  decision  makers  were  modeled  as  Construct  agents  (a  brief 
introduction  of  Construct  was  included  in  Vignette  A,  above).  Each  of  the  provocations  (as 
shown  in  Table  14.12)  represented  a  source  of  knowledge  that  contributed  to  a  pro-war  belief 
Provocations  represented  a  source  of  knowledge  that  contribute  to  a  pro-peace  (that  is,  anti-war) 
mentality.  Agents  started  with  random  distributions  of  both  pro-war  and  pro-peace  knowledge, 
and  were  allowed  to  interact  (their  interactions  were  constrained  by  the  found  social  network  in 
the  data  sources).  Additional  knowledge  bits  that  did  not  influence  pro-war  belief  were  used  to 
provide  points  of  contrast  for  similarity  measures.  At  various  points  through  the  time-course  si¬ 
mulation,  the  number  of  agents  who  had  the  pro-war  belief  was  measured. 

Different  from  the  goals  in  Vignette  A,  in  Vignette  B  the  interest  was  in  the  impact  of  re¬ 
sponse  time  on  the  number  of  decision-makers  with  the  pro-war  belief  Four  different  response 
times  were  used,  and  it  was  assumed  that  all  the  responses  were  coordinated  for  that  chosen 
time-point.  It  was  also  assumed  that  all  provocations  detailed  in  the  scenario  occurred,  even  if 
tensions  were  very  low  or  non-existent.  As  such,  these  are  conservative  projections  of  impact. 
The  experimental  design  is  shown  in  Table  4.12. 


TABLE  14.12  Construct  experiment  design.  Vignette  B 


Parameter 

Number  of  Values 

Values 

Agent  Networks 

2 

PACOM,  CENTCOM 

Responses 

4 

None,  Day  1,  Day  14,  Day  20 

Total  Knowledge  Facts 

1 

450 

Total  “Similarity”  Facts 

1 

300 

Total  “Pro  War”  Facts 

1 

50 

Total  “Pro  Peace”  Facts 

1 

100 

Each  of  the  condition  sets  were  run  for  one  hundred  trials,  for  a  total  of  800  simulation  runs. 
In  the  set  of  graphs  in  Fig.  14.34,  the  dashed  lines  represents  the  average  value  of  the  “no  re¬ 
sponse”  case  over  the  time-course,  meaning  that  no  actions  were  taken  to  defuse  the  situation  in 
those  runs.  The  solid  lines  represent  the  average  value  of  the  response  case  shown,  each  figure 
represents  a  different  response-time.  The  marks  show  the  values  of  individual  runs  over  the  si¬ 
mulation’s  time-course  for  the  response  case.  The  general  assessment  of  these  charts  presents  no 
surprise,  the  earlier  the  response,  the  better.  Early  injections  of  “pro-peace”  knowledge  causes 
agents  to  share  that  knowledge  early  and  often,  presenting  an  outsized  impact  on  the  overall 
trends. 
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14.4.3  Organizational  Models 

In  Vignette  B,  the  situation  between  India  and  Pakistan  intensifies.  Therefore,  US  levers  with 
high-level  contacts  with  the  government  officials  are  brought  in  to  deescalate  the  impending  cri¬ 
sis.  The  organization  models  of  the  two  countries’  security  structures  remain  the  same  as  de¬ 
picted  in  Figs.  14.9  and  14.10.  The  only  refinement  made  to  these  models  in  Vignette  B  is  the 
addition  of  new  high-level  US  levers  and  their  interactions  with  the  government  officials  of  the 
two  countries.  Figure  14.35  displays  the  organization  model  of  Pakistan  with  a  new  US  lever 
(Chairman,  Joint  Chief  of  Staff).  The  organization  model  of  Pakistan  NSC  itself  remains  un¬ 
changed.  Similarly,  Fig.  14.36  shows  the  model  of  India  NSC  with  new  US  levers  (Chairman, 
Joint  Chiefs  of  Staff  and  National  Security  Advisor). 
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Fig.  14.34  Comparison  of  the  base  case  (“No  Reponse”)  to  reponses  occurring  at  specific  points 

in  the  simulation's  time-course 
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Fig.  14.35  Pakistani  Government  organization  model  for  Vignette  B 
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Fig.  14.36  Indian  Government  organization  model  for  Vignette  B 
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14.4.4  Analysis  of  Organization  Models 


Tables  14.13  and  14.14  show  the  influence  of  new  levers  into  the  Pakistani  and  Indian  Gov¬ 
ernment  models. 


TABLE  14.13  CENTCOM  sphere  of  influence  report  for  new  US  lever 


Lcvflr 

Xoflueiiced  DAis 

Chaimian.  Joint  Chief  of  StaJtt 

{Defense  Minister^  Chief  of  General  Staff)  — ►  Anny 

TABLE  14.14  PACOM  sphere  of  influence  report  for  new  US  levers 


Lev'er 

InflueDced  DMs 

National  Securing  Ad\-i.3or 

(National  Securin'  Ad^'isor, ,  Kfinister  of  Home 
Affairs.-Depun^ Prime  Minister)  — ►  {Opposition  Parn- 
Leader,.  Prime  Minister)  — ►  {President  Chief  of  Army 
Staff)  —5^  Army 

Chairman^  Joint  Chief  of  Staff 

{Chairman  Chiefs  of  Staff  Committee.  National  Securin' 
Adi-iior)  — ^  {Defense  Minister,  Director  General  DLA) 
Defense  Secretary-  — hfinister  of  Home 

Affairs.  Depun- Prime  Minister  — »  Opposition  Parn- 
Leader  ^  Prime  Minister  — »^{Pre3ident  Chief  of  Army 
Staff")  — Army 

Table  14.15  displays  the  sphere  of  influence  report  for  the  common  US  levers  across  both  or¬ 
ganization  models  developed  by  the  two  commands. 


TABLE  14.15  Sphere  of  influence  of  common  levers 


Lev'er 

InfluciDced  D]\ls 

Ambass-ador  (CENTCONf) 

Minister  of  Foreim  Afffirs  — ^  President  {Defense 
Minister,  Chief  of  Geueral  Staff")  — Army 

Chairman.  Joint  Chief  of  Staff" 
(CENTCO^^) 

{Defense  Minister.  Chief  of  General  Staff)  — ►  Army 

Ambassador  (PACON!) 

Minister  of  External  x^ffair  s  Prime  Minister  — ^ 

{President  Chief  of  xAnny  Staff)  —*■  Army 

Chairman.  Joint  Chief  of  Staff" 
(PACOM) 

{Chairm-an  Chiefs  of  Staff"  Committee^  National  Securin^ 
Ad^-isor)  — ►  {D^ense  MmisteT;  Director  General  DLA) 
Defense  Secretary'  — ^  Minister  of  Home 

Affairs  Depun' Prime  Minister  Oppo  sition  Parn' 

Leader  Prime  Minister  — b{Pre3ident  Chief  of  xArmy 
Staff")  — *  Army 
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14.4.5  Situational  Assessment 


The  Pythia  models  for  both  CENTCOM  and  PACOM  were  updated  on  the  scenario  date  of  June 
30,  2002  to  reflect  the  new  situation  in  Vignette  B.  The  possibility  that  both  nations  could  begin 
preparation  of  their  nuclear  forces  for  possible  use  was  added  to  the  models  as  well  as  the  possi¬ 
bility  of  having  high  level  talks  between  the  two  nations.  New  levers  were  added  to  each  model 
(Fig.  14.37  and  14.38).  The  CENTCOM  Pythia  model  is  shown  in  Fig.  14.37.  Key  events  in¬ 
clude  Pakistan  Religious  organizations  continue  protests”  starting  07/01/2002,  “Indian  officials 
continue  to  make  accusations  about  Pakistan”  on  the  same  day,  “Indian  Political  Leaders  call  for 
action  against  Pakistan”  immediately  thereafter,  and  “India  and  Pakistan  patrols  and  forces  ex¬ 
change  fire  along  border”  during  07/06/2002.  Key  effects  are  “Pakistan  is  moving  to  Escalate”, 
“Pakistani  forces  engage  in  large  scale  skirmishes  along  the  border”,  and  “Pakistani  nuclear  fa¬ 
cilities  begin  preparation  for  the  use  of  Nucs  (nuclear  weapons)”.  The  messages  of  the  Levers  are 
upgraded  and  the  US  Chairman  of  the  Joint  Chiefs  of  Staff  is  added  as  a  lever. 


Fig.  14.37  CENTCOM  Pythia  model  as  of  June  30,  2002 


The  updated  PACOM  Pythia  model  is  shown  in  Fig.  14.38.  The  PACOM  model  has  a  similar 
set  of  events  as  the  CENTCOM  model:  “Indian  political  party  activist  stir  up  demonstrations 
against  Pakistan”  on  07/1/2002,  “Pakistan  religious  organizations  continue  to  hold  violent  dem¬ 
onstrations”  on  the  same  day,  “Pakistan  continues  to  make  accusations  about  India”  on  day 
07/3/2002,  and  “Pakistan  forces  and  teams  observed  assembling  in  several  areas”  on  07/09/2002. 
Key  effects  are  “Indian  Government  decides  to  escalate”,  “Indian  Air  Force  Increases  Sortie 
Rate”,  and  “Indian  Organizations  Begin  Preparation  for  the  Use  of  Nuclear  Weapons”.  The  mes¬ 
sages  from  the  levers  are  updated  and  the  US  National  Security  Advisor,  and  the  US  Chairman 
of  the  Joint  Chiefs  of  Staff  are  added  as  levers. 
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Fig.  14.38  PACOM  Pythia  model  as  of  June  30,  2002 


14.4.6  Assess  Situation  and  COA  Analysis 

An  analysis  that  was  similar  to  the  one  performed  for  Vignette  A  was  conducted  for  both  models. 
The  final  probability  profiles  generated  along  with  the  suggested  COA  for  the  CENTCOM  and 
PACOM  models  are  shown  in  Figs.  14.39  and  14.40.  Both  analyses  indicate  that  early  use  of 
levers  may  cause  both  sides  to  be  willing  to  open  talks  with  one  another,  but  also  show  that 
movement  of  troops  will  likely  cause  both  sides  to  escalate  preparation  for  possible  nuclear  con¬ 
frontation. 

At  this  point  CENTCOM  and  PACOM  agree  to  merge  their  models  for  a  combined  analysis. 
The  combined  model  is  shown  in  Fig.  14.41  with  the  PACOM  model  on  the  top  and  CENTCOM 
model  on  the  bottom.  In  this  model,  the  node  in  the  CENTCOM  model  that  represents  Pakistani 
Chief  of  General  Staff  ordering  Pakistani  army  to  move  forces  to  the  border  is  connected  to  the 
PACOM  model  node  that  represents  the  event  of  India  observing  Pakistani  forces  assembling  in 
several  areas  (see  darken  arrow).  A  new  node  (circled)  is  added  that  represents  the  Pakistani  and 
Indian  ministers  of  foreign  affairs  agreeing  to  have  talks.  The  type  of  analysis  that  was  done  for 
the  individual  models  was  done  for  the  fused  model.  The  messaging  and  timing  of  the  actions  by 
the  levers  was  synchronized  and  the  model  was  run  showing  the  probability  of  key  effects  over 
time.  The  result  after  adjusting  the  timing  of  the  events  to  create  the  “best”  probability  profiles  is 
shown  in  Fig.  14.42 
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Suggested  COAfor  Worst  Case 

•  US  Pol-Mil  outlines  US  concerns  of  possible 
escalation  and  suggests  opportunities  to 
reduce  tensions  @(07/01/2002) 

•  GENICOM  J5  gives  same  message  to  MoFA 
staff®  (07/01/2002) 

•  GENICOM  J2  shares  assessment  of  possible 
India  courses  of  action  if  tensions  continue  to 
rise  @(07/02/2002) 

•  GENICOM  Commander  suggests  India  and 
Pakistan  hold  meeting  to  resolve  situation  @ 
(07/03/2002) 

•  US  Ambassador  outlines  US  concerns  of 
possible  escalation  and  argues  for  need  to 
reduce  tensions  before  India  takes  its  own 
military  action  @  (07/03/2002) 

•  US  CJCS  outlines  US  concernsof  possible 
escalation  to  Ministerof  Defence  (Pakistan) 
and  Chief,  General  Staff,  and  argues  for  need 
to  reduce  tensions  before  India  takes  action 
to  blunttheir  perception  of  imminent 
preemptive  attack  @  (07/05/2002) 


Fig.  14.39  GENICOM  analysis  for  Vignette  B 


Suggested  COA  for  Worst  Case 
Adjusted  Possible  Actions  and  liming 
PACOM  J2  shares  assessment  of  possible  Pakistan 
COAs  if  tensions  continue  to  rise  @  (07/02/2002) 
PACOM  J5  outlines  US  concerns  of  possible 
escalation  to  India  Defense  Secretary  Staff  and 
suggests  opportunities  to  reduce  tensions  with 
Pakistan  @  (07/02/2002) 

PACOM  Commander  offers  to  facilitate  talks  between 
Pakistan  and  Indian  military  leaders  @  (07/04/2002) 

US  National  Security  Advisor  discusses  situation 
with  Indian  NSA  @  (07/05/2002) 

US  Ambassador  outlines  US  concerns  of  possible 
escalation  and  argues  for  need  to  reduce  tensions 
before  Pakistan  preps  for  preemptive  military  action 
@(07/05/2002) 

US  CJCS  outlines  US  concerns  of  possible 
escalation  in  talks  with  Indian  Chair  COS  and  Army 
COS,  and  argues  for  need  to  reduce  tensions  before 
Pakistan  sees  need  for  preemptive  military  action  @ 
(07/06/2002) 

US  National  Security  Advisor  re-enforces  US  CJCS 
message  with  Deputy  Prime  Minister®  (07/09/2002) 


Fig.  14.40  CENTCOM  analysis  for  Vignette  B 
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Fig.  14.41  Combined  Pythia  model 


Probability  ProHle  for  COA3  Combined  all  dip  with  feedbaclHifl 


^Xj 


'Indian  organizations  begin  preparation  lor  use  of  nudear  capabity 
Pakistan  is  moving  to  escalate 


Analysis  based  on  India  and  Pakistan 
forces  exchanging  fire  along  border  in  12 
days  (07/12/2002). 

•  As  a  result  of  coordinated  CENTCOM 
and  PACOM  actions  to  try  and  help 
Pakistan  and  India  de-escalate,  both 
countries  seems  to  be  willing  to  de- 
escalate  for  a  while 

•  Both  countries  could  increase  likelihood 
that  nuclear  options  will  be  considered 

•  Engagement  of  forces  increases 
likelihood  of  Pakistani  escalation 
including  preparation  of  nuclear  options 


Pakistani  nuclear  facilities  begin  preparing  for  possible  use 
Indian  and  Pakistani  Ministers  agrees  to  have  talcs 


Fig.  14.42  Probability  profiles  for  combined  model 
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14.4.7  Merged  COA 

The  analysis  indicated  that  the  best  COA  be  based  on  the  following  concepts:  (1)  To  use  the 
lower  level  levers  first,  (2)  Attempt  to  have  the  same  type  of  interaction  occur  simultaneously  in 
both  countries,  (3)  Military  to  Military  contacts  occur  first,  (4)  Pol  Mil  officer  can  also  make  ear¬ 
ly  contact  and  the  Ambassadors  follow,  and  (5)  then  the  more  senior  military  such  as  Chainman 
Joint  Chiefs  and  US  National  Security  Advisor  have  their  interactions. 

The  final  COA  based  on  the  analysis  with  the  combined  Pythia  model  is  shown  In  Table 
14.16. 

TABLE  14.16  Final  COA  for  combined  CENTCOM  PACOM  actions 


Action 

Day 

US  Pol-Mil  outlines  US  concerns  of  possible  escalation  and  suggests  opportunities  to  reduce 
tensions  to  Pakistani  Opposition  Leader 

30 

CENTCOM  J5  outlines  US  concerns  of  possible  escalation  and  suggests  opportunities  to  reduce 
tensions  to  Minster  of  Foreign  Affairs  staff 

31* 

CENTCOM  J2  shares  assessment  of  possible  India  courses  of  action  if  tensions  continue  to  rise  with 
staff  of  the  Chief  of  General  Staff  for  Intel  and  the  Staff  of  ISI 

31 

PACOM  J5  outlines  US  concerns  of  possible  escalation  to  India  Defense  Secretary  Staff  and 
suggests  opportunities  to  reduce  tensions  with  Pakistan 

31 

PACOM  J2  shares  assessment  of  possible  Pakistan  courses  of  action  if  tensions  continue  to  rise  with 
the  Director  General  of  the  Defense  Intelligence  Agency 

31 

CENTCOM  Commander  suggests  India  and  Pakistan  hold  meeting  to  resolve  situation  to  Pakistani 
President 

33* 

PACOM  commander  offers  to  facilitate  talks  between  Pakistan  and  Indian  military  leaders  to  build 
confidence  and  reduce  tensions 

33 

US  CJCS  outlines  US  concerns  of  possible  escalation  to  Pakistan  Minister  of  Defence  and  Chief, 
General  Staff,  and  argues  for  need  to  reduce  tensions  before  India  takes  action  to  blunt  their 
perception  of  imminent  preemptive  attack 

34 

US  CJCS  outlines  US  concerns  of  possible  escalation  in  talks  with  Indian  Chair  COS  and  Army  COS, 
and  argues  for  need  as  superior  power  to  reduce  tensions  before  Pakistan  sees  need  for  preemptive 
military  action 

34* 

US  Ambassador  outlines  US  concerns  of  possible  escalation  and  argues  for  need  to  reduce  tensions 
before  India  takes  its  own  military  action  to  Pakistan  Minister  of  Foreign  Affairs 

34* 

US  Ambassador  outlines  US  concerns  of  possible  escalation  and  argues  for  need  to  reduce  tensions 
before  Pakistan  preps  for  preemptive  military  action  to  the  Indian  Minister  of  External  Affairs 

34* 

US  National  Security  Advisor  outlines  US  concerns  of  possible  escalation  to  Deputy  Prime  Minister 
and  argues  for  need  to  reduce  tensions  before  Pakistan  preps  for  preemptive  military  action  @9 

36* 

*  Means  the  timing  has  been  adjusted  from  the  individual  model  analysis 


The  following  summary  of  the  assessment  based  on  the  analysis  of  the  combined  model  was 
created.  Both  COCOMs  should  take  coordinated  actions  to  use  all  levers  in  a  synchronized  se¬ 
quence  as  soon  as  possible.  Messages  include  (a)  US  concerns  of  possible  escalation  and  sugges¬ 
tion  of  opportunities  to  reduce  tensions,  (b)  US  will  help  facilitate  meetings  between  appropriate 
parties  from  the  two  countries  (c)  CJCS  should  outline  US  concerns  of  possible  escalation  with 
both  countries  and  with  Pakistani  senior  official  and  argue  for  need  to  reduce  tensions  before 
India  takes  action  to  blunt  their  perception  of  imminent  preemptive  attack,  (d)  the  CJCS  should 
discuss  with  India  the  need  as  superior  power  to  reduce  tensions  before  Pakistan  sees  the  need 
for  preemptive  military  action,  (e)  US  Ambassadors  should  make  appropriate  arguments  with 
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their  contacts,  and  (f)  the  US  National  Security  Advisor  should  outline  US  concerns  of  possible 
escalation  to  each  country.  Furthermore  the  models  indicate  US  only  actions  may  be  insufficient; 
therefore  the  US  should  pursue  support  from  other  countries  who  are  friends  with  India  and  Pa¬ 
kistan. 

14.5  Conclusions 

The  scenario  increased  the  understanding  of  the  utility  of  Pythia  and  timed  influence  net  model¬ 
ing  and  analysis  to  support  Situation  Assessment  and  Course  of  Action  (CO  A)  Evaluation  in  sit¬ 
uations  where  deterrence  is  a  key  objective.  The  exercise  demonstrated  how  Pythia  could  pro¬ 
vide  insights  regarding  possible  COAs  to  maintain  stability  and  control  escalation.  The  multi¬ 
model  enhanced  Pythia  Timed  Influence  Net  models  were  used  to  identify  potential  adversary 
influence  levers,  their  associated  activities  and  timing,  and  gaps  in  information.  Pythia  enabled 
modeling  of  the  influence  levers  and  their  potential  effects  on  organizational  perceptions  and  de¬ 
cisions  of  key  individuals  within  both  governments.  The  models  included  consideration  of  the 
messages  that  would  be  used  by  the  levers  and  the  impact  of  combined  messages  on  two  adversa¬ 
ries  over  time.  Computational  experimentation  with  varied  timing  enabled  the  ordering  of  mul¬ 
ti-state  activities  for  maximum  combined  effect.  In  the  scenario  the  models  demonstrated  the 
value  of  early  intervention  (despite  potential  costs).  In  the  end  the  models  showed  that  the  inter¬ 
national  community,  particularly  friends  of  the  two  adversaries,  may  be  required  to  effectively 
influence  behaviors.  It  appears  that  Pythia,  along  with  the  other  models  used  in  the  the  two  vig¬ 
nettes,  could  enhance  the  analysis  of  alternatives  in  command  centers  that  are  engaged  in  deter¬ 
rence  operations. 
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Appendix  A 


Proof  of  Lemma  3.2 


Applying  the  Bayes  Rule,  we  write 
P(xr‘  I  B)P{B) 


p(5ixr‘)= 


p(xr‘) 


Where,  due  to  the  Theorem  of  Total  Probability,  we  have 

p(xr‘i^)= 

x„=0,l 

From  the  Bayes  Rule  we  also  have. 


p(xr  I B) = 


p(^|x;)P(x;) 

P(B) 


Substituting  (A.2)  and  (A.3)  in  (AT),  we  obtain: 

PiB  I  xr‘)  =  Y^PiB  I  x;)p«)p-‘(xr')  =  I  i  <■') 

X„=0,1  =04 


(AT) 


(A.2) 


(A.3) 


(A.4) 


Where  in  (A.4)  we  used  the  definition  of  conditional  probability /’(x„  |  x"  ')  =  P{X\)P  ’(-^i"  *)  • 
Using  expression  (4)  in  Section  III  and  substituting  in  (A.4),  we  obtain. 


{1  +  V,(xr-')[1-P(R)]P-‘(R)} 


sgn/t„_i(xf  ^) 


+  K 


Y,p(x„  I  xr-'){i + K(x:)[i  -  p(B)]p-'iB)} 


n-\ 
isgn/t„(xf ) 


^^„_l^|l-sgn/t„_i(xf  ^) 

•{1 +''.«)}' 


-sgn/t„(xf) 


=0„+l 


(A.5) 


x„=0,l 


Observing  (A.5),  we  notice  that  \f{Q„  + 1)  g  [0,1] ,  then  /2„_i(x"“')  must  be  necessarily  negative, 
reducing  the  left  part  of  the  equality  in  (A.5)  to  1  +  /i„_](x"“’)  •  on  the  other  hand, 

(Q„  + 1)  e  [l,P“'(.5)]then  the  left  part  of  (A.5)  must  necessarily  reduce  to 
1  +  /2„_,(xr')[l  -  P{b)\P~\b),  with  h„_  .j(x"  ')  positive.  The  above  observations  clearly  lead  to 
the  result  in  the  lemma. 
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Proof  of  Lemma  3.3 


Due  to  the  Bayes  Rule,  we  have: 
P{x:\B)P{B) 


p{B\x:)= 


Pio 


Due  to  the  independence  assumption,  we  have: 
PK\B)  _-^P(x,\B) 


n 


/=1 


P{x,) 


where 

P(x,|g)_P(5|v,) 

P(x,)  P{B) 

Substituting  (A.8)  in  (A.7)  and  then  (A.6),  we  obtain: 
P{B\x")  =  p-^’'-^\B)f[P{B\x,) 


i=\ 


Substituting  expression  (10)  in  (A.9)  we  obtain  the  expression  in  the  lemma. 

Proof  of  Lemma  3.4 


Due  to  the  Bayes  Rule,  we  have: 

P{B  \xl)  _  P{xl  I B) 

p[b)  ~  P«) 

Then,  due  to  (13),  we  obtain  from  (A.  10), 

P{B\x:)  P{x,\B)x^P{x,\x,_„B) 

P{b)  P{x,)  li  P{x,\x,_,) 

Applying  the  Bayes  Chain  Rule,  we  have: 

P(x.  I  x._i,5)P(x._i  I  B)P(b)  =  P{B  \  x.,x._i)P(x.  I  x._i)P(x._i) 
where, 

P{x,_,\B)P(B)  =  P{B\x,_,)P{x,_,) 


(A.6) 

(A.7) 

(A.8) 

(A.9) 


(A.10) 

(A.  11) 

(A.  12) 
(A.13) 


Substituting  (A.13)  in  (A.  12)  we  then  obtain: 

P(x,  I  x,._i,g)  ^  PjB  I  x,.,x,_i) . .  ^  ^ 

P(x,|x,_,)  P(5|X,_,)  ’  “ 


P{x,\B)  _  P{B\x,) 

P{x,)  ~  P(B) 

Where,  directly  from  the  results  in  Lemma  1,  we  have: 


P{B  I  x,)=  {l  +  ^i«(x,)[l  -  ’'"-'{l  +  hi‘\x,)f 


■sgn  /if'*  (x; ) 


where 


i>2 


I  av.i-1  ; 

ip(5)[i-p(5)r'[a,,,,-i] ;  ifa,,,e[i,p-'(5)] 


(A.  14) 

(A.15) 

(A.16) 
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(A.17) 

Substitution  of  expression  (A.  14)  and  (A.17)  in  (A.l  1),  in  conjunction  with  expression  (14),  give 
the  result  in  the  lemma. 

Proof  of  Lemma  3.5 

Due  to  the  Bayes  Rule  and  the  Theorem  of  Total  Probability,  we  have: 

p(s)=2;d5k,’Hv)  (A.18) 

xf 

Substituting  in  (A.18)  the  expression  (27)  for  the  conditional  probability  p(5  I  ^i")j  we  obtain: 


X  7^(xr)J  +  P-'{b\\  -  P(5)]max/^j(x,.)|+ 

xf  :^/ti(xJ>0 

X  7>(xi'’)+  X  +  min^(A)}=l 

i=l  i=l 

which  gives  after  simplification: 

[1-P(5)]  X  H<)max/i,(x,)  +  P(5)  X  ^(<)  min/?j(x,.)  =  0 

jVj"  :^/(i  (x,  )>0  x(':^//j(x,  )<0 


(A.19) 


(A.20) 


137 


138 


APPENDIX  B 


Pythia 

Peter  W.  Pachowicz,  Lee  W.  Wagenhals,  John  Pham,  and  Alexander  H.  Levis 

Pythia,  a  timed  influence  net  modeling  and  simulation  tool  for  course  of  action  development, 
evaluation  and  selection  in  the  context  of  effects  based  planning,  [2]  and  (3)  Temper,  a  temporal 
planning  and  temporal  reasoning  tool  using  time  interval  logic.  [3] 


Figure  1:  The  Interface  to  the  Analyst’s  Toolbox 

The  above-mentioned  software  has  been  re-engineered  from  being  a  stand-alone  applications  in¬ 
to  the  state-of-the-art  client-server  computing  environment.  At  this  time,  only  Pythia  1.5  has 
been  brought  into  the  distributed  infrastructure,  with  the  remaining  tools  to  follow  shortly.  Each 
of  these  tools  has  been  converted  to  a  server-centric  application  for  multi-user  and  multi-process 
computing;  the  environment  relies  on  the  Citrix  Presentation  Server  for  integration,  security,  and 
maintenance. 

Figure  2  shows  the  Presentation  Services  approach  incorporated  in  the  development  of  the  ana¬ 
lyst’s  suite.  While  each  application  is  run  on  a  server,  the  input/output  services  are  controlled  and 
displayed  through  a  client  machine  that  typically  is  a  PC  or  laptop  remotely  located  from  the 
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server.  An  individual  user  must  obtain  an  account  and  install  a  few  system  components  on  a 
client  machine.  Login  and  all  interactions  with  analyst  tools  are  performed  using  a  client-GUI.  A 
server  performs  all  computations  and  generates  displays  presented  virtually  on  a  client  machine. 
A  user  does  not  have  to  know  the  location  of  the  computing  resources  and  is  not  limited  by  the 
computational  power  of  his/her  client  machine,  meaning  that  operators  in  the  field  can  use  the 
tool  with  relatively  small  devices  with  limited  computing  power  and  memory.  Moreover,  a  user 
can  open  several  concurrent  processes  of  the  same  (or  different)  application  with  different  data 
sets.  Only  the  power  of  the  server-side  computing  infrastructure  and  the  number  of  Citrix  li¬ 
censes  limits  the  number  of  application  processes  that  can  be  open  concurrently.  Our  current  ef¬ 
forts  are  also  focused  on  providing  a  cross-application  interfacing  through  model  and  data  ex¬ 
change  mechanisms.  This  will  allow  us  to  apply  complementary  tools  to  the  same  modeling  and 
simulation  problem. 


Client  Server 


Figure  2:  Presentation  Services  Approach 

A  Citrix  Presentation  Services  architecture  has  been  chosen  for  the  development  of  the  client- 
server  computing  infrastructure.  In  short,  Citrix  Presentation  Services  technology  (i)  provides 
virtual  delivery  of  an  application  through  a  centralized  and  secure  distributed  architecture,  (ii) 
arranges  a  virtual  view  of  system  resources  (file  system,  registry,  named  objects,  etc.),  and  (iii) 
supports  a  variety  of  hardware/software/OS  technologies  no  matter  the  infrastructure  diversity. 
The  infrastructure  on  the  server-side  can  involve  one  or  more  farms  of  application  servers  de¬ 
pending  on  their  geographic  distribution.  Each  server  farm  can  be  divided  into  zones  depending 
on  the  complexity  of  the  local  network  and  the  number  of  connected  servers.  Incoming  tasks  are 
automatically  routed  to  application  servers  depending  on  their  resources  and  current  load.  Con¬ 
nectivity  with  external  databases  is  arranged.  Citrix  provides  higher-level  middleware  (APIs,  and 
SDKs)  for  a  middleware  customization  in  order  to  arrange  total  control  over  the  client,  network 
delivery,  and  server  services.  Such  a  centralized  computing  architecture,  allows  diverse  users  to 
develop  and  maintain  their  application  models,  perform  simulations,  and  apply  different  analyti¬ 
cal  tools,  while  the  application  developer  can  independently  continue  to  enhance  the  capabilities 
of  these  tools. 
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Pythia’s  Time  Influence  Net  Modeling  (TIN) 

Pythia  is  using  a  Time  Influence  Net  modeling  extension  to  the  Influence  Net  modeling  para¬ 
digm.  An  Influence  Net  (IN)  is  a  Directed  Acyclic  Graph  where  nodes  in  a  graph  represent  ran¬ 
dom  variables  and  the  edges  between  nodes  represent  causal  relationships.  While  mathematically 
IN  are  similar  to  Bayesian  Nets  (BN)  [4],  there  are  key  differences.  The  most  important  is  that 
IN  uses  CAST  Logic  [5,6]  to  enhance  knowledge  elicitation  from  subject  matter  experts  in  defin¬ 
ing  precise  a-priori  conditional  probabilities  used  by  BN.  IN  modeling  is  accomplished  by  creat¬ 
ing  a  series  of  cause  and  effect  relationships  between  desired  (and  undesired)  effects  and  the  set 
of  actions  that  might  impact  their  occurrence.  The  actionable  events  in  IN  are  drawn  as  root 
nodes  (nodes  without  incoming  edges).  Desired  effects,  or  objectives  the  decision  maker  is  inter¬ 
ested  in,  are  modeled  as  leaf  nodes  (nodes  without  outgoing  edges).  In  some  cases,  internal  nodes 
can  be  effects  of  interest,  as  well. 

Figure  3  shows  an  example  IN  that  has  been  created  with  the  Pythia  tool.  The  actionable  nodes 
(nodes  on  the  left)  have  been  assigned  marginal  probability  values  -  a  probability  indicating 
whether  or  not  an  action  will  be  taken.  The  other  nodes  have  assigned  baseline  probability  in  the 
CAST  Logic  -  a  probability  indicating  whether  the  random  variable  the  node  represents  will  be 
true  on  its  own  without  the  influence  of  any  parent  nodes  in  the  model.  The  edges  (links  between 
nodes)  have  casual  strength  values  (first  two  values)  indicating  the  degree  of  influence  that  a 
parent  node  has  on  its  child  in  the  CAST  Logic.  The  first  strength  value  indicates  the  effect  on 
the  child  node  when  the  parent  is  ‘True.’  The  second  strength  value  indicates  the  effect  on  the 
child  node  when  the  parent  is  ‘False.’ 


Figure  3:  Example  Time  Influence  Net 

The  TIN  modeling  extension  allows  the  modeler  to  allocate  time  delays  associated  with  nodes 
and  edges,  representing  an  impact  of  events  (actions  or  effects)  that  takes  some  time  to  reach  and 
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be  processed  by  the  affected  events  or  conditions.  For  example,  the  third  value  assigned  to  edges 
(see  Figure  3)  represents  time  delays  in  time  units.  Consequently,  Time  Stamps  are  associated 
with  each  node  (including  the  action  nodes).  Hence,  a  user  can  specify  a  Coarse  of  Action 
(COA),  as  a  time  sequence,  on  the  action  nodes,  which  are  propagated  through  the  network  and 
trigger  changes  to  the  probability  values  of  the  effected  nodes.  The  change  in  probability  value  of 
desired  effect  (leaf  node)  can  be  observed  over  time.  Figure  4  illustrates  the  change  in  probability 
value  for  the  effect  node  ‘Country  B  Agrees  to  Withdraw’  for  the  following  COA  on  the  action 
nodes: 

COA  =  [  ‘Country  G  Begins  Diplomatic  Efforts’  at  time  1,  & 

‘International  Community  Threatens  Sanctions’  at  time  2,  & 

‘Country  G  Employs  Successful  Covet  Operations’  at  time  5  ] 

Such  a  probability  profile  in  TIN  modeling  provides  important  complementary  information  about 
the  probability  of  success  of  a  desirable  effect  when  studied  over  time.  First,  the  final  probability 
level  is  given.  Second,  an  unwanted  drop  in  the  probability  level  over  time  can  be  detected.  And 
third,  the  time  required  to  reach  the  final  probability  level  is  determined. 


Figure  4:  Example  Probability  Profile 


Pythia’s  Capabilities 

On  top  of  IN/TIN  model  building  capabilities,  Pythia  has  two  tools  developed  to  analyze  and  si¬ 
mulate  IN/TIN  models.  The  Static  Propagation  tool  allows  for  computing  the  likelihood  of  oc¬ 
currence  of  corresponding  events  in  a  static  situation  -  when  time  data  is  not  taken  into  account. 
A  user  can  also  perform  two  types  of  Sensitivity  Analysis  on  a  given  IN  model:  (i)  sensitivity  of 
input  -  sensitivity  of  effect  to  actionable  events,  and  (ii)  sensitivity  of  influence  -  sensitivity  of 
an  effect  to  the  CAST  Logic  parameters  associated  with  edges. 


142 


In  addition  to  TIN  modeling,  Pythia  has  a  wide  range  of  tools  dedicated  to  TIN  model  analysis. 
For  example,  once  a  COA  is  defined,  Pythia  generates  probability  profiles  of  selected  events 
over  time,  as  described  in  Section  3.  Pythia  allows  for  comparing  CO  As  based  on  computed 
probability  profiles.  A  SAF  tool  {Sets  of  Actions  Finder)  finds  various  combinations  of  actions 
that  cause  the  probability  of  a  desired  effect  to  be  above  a  certain  threshold.  An  ECAD-EA  tool 
(Effective  Course  of  Action  Determination  using  Evolutionary  Algorithms  methodology)  allows 
for  finding  the  best  COAs  according  to  user  specified  metrics,  temporal  and  casual  constraints, 
and  windows  of  observation  and  opportunity.  Pythia  also  used  APIs  from  the  TEMPER  temporal 
logic  tool.  Specifically  the  Point-Interval  Logic  {PIL)  engine,  together  with  a  What-If  tool  pro¬ 
vides  an  opportunity  to  transform  a  TIN  into  a  corresponding  point-graph  and  subsequently  an¬ 
swer  temporal  queries  and  perform  what-if  analysis.  Other  tools  allow  for  model  transformation 
and  more  advanced  model  analysis. 
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Appendix  C 


THE  C2  WIND  TUNNEL 

The  C2WT  is  an  integrated,  multi-modeling  simulation  environment.  Its  framework  uses  a  dis¬ 
crete  event  model  of  computation  as  the  common  semantic  framework  for  the  precise  integration 
of  an  extensible  range  of  simulation  engines,  using  the  Run-Time  Infrastructure  (RTI)  of  the 
High  Level  Architecture  (HLA)  platform.  The  C2WT  offers  a  solution  for  multi-model  simula¬ 
tion  by  decomposing  the  problem  into  model  integration  and  experiment  or  simulation  integra¬ 
tion  tasks. 

Model  Integration:  Integrated  experiments  or  simulations  are  specified  by  a  suite  of  domain  spe¬ 
cific  models,  including  for  instance:  human  organizations  (expressed  using  the  Colored  Petri  Net 
modeling  language  and  social  networks),  networks  (OMNET-i-i-  network  simulation  language), 
physical  platforms  (Matlab/Simulink  based  models),  and  the  physical  environment  (e.g.,  Google 
Earth).  While  the  individual  behaviors  simulated  by  the  different  simulation  models  are  essential 
they  must  interact  as  specified  by  the  workflow  for  the  particular  simulation  or  experiment.  Their 
interactions  need  to  be  formally  captured  and  the  simulation  of  the  components  needs  to  be  coor¬ 
dinated.  This  is  a  significant  challenge,  since  the  component  models  are  defined  using  dramati¬ 
cally  different  domain  specific  modeling  languages.  The  C2WT,  therefore,  uses  the  meta¬ 
modeling  technology  and  the  Vanderbilt  MIC  tool  suited  The  key  new  component  is  the  Model 
Integration  Layer  (Fig.  2),  where  a  dedicated  Model  Integration  Language  (MIL)  is  used  for 
model  integration.  The  MIL  consists  of  a  carefully  selected  collection  of  modeling  concepts  that 
represent  the  domain-specific  simulation  tools. 

Model-based  Experiment  Integration:  C2WT  uses  the  MIC  model  interpretation  infrastructure 
for  the  generators  that  automatically  integrate  heterogeneous  experiments  on  the  HLA  platform 
deployed  on  a  distributed  computing  environment.  After  finalizing  the  component  models,  the 
integration  models,  and  setting  the  parameters,  the  MIL  model  interpreters  generate  all  the  ne¬ 
cessary  configuration  information  and  run-time  code.  The  architecture  of  the  C2WT  is  shown  in 
Fig.  2.  Each  modeling  language  is  depicted  as  a  federate  on  which  models  built  using  that  lan¬ 
guage  run. 

Time  Management  in  C2WT:  Time  Management  is  critical  to  preserve  causality  with  simulations 
operating  at  different  timescales.  The  C2WT  builds  upon  the  time  management  features  of  the 
underlying  HLA  standard,  which  has  provision  for  both  discrete  time  and  discrete  event  models. 


MIC  is  a  meta-programmable  Model-Integrated  Computing  (MIC)  tool  suite  for  integrating  models,  to  manage  the  configuration  and  deploy¬ 
ment  of  scenarios  in  the  simulation  environment,  and  to  generate  the  necessary  interface  code  for  each  integrated  simulation  platform.  It  has 
evolved  over  two  decades  of  research  at  the  Institute  for  Software  Integrated  Systems  at  Vanderbilt  University  and  is  now  used  in  a  wide  range 
of  government  and  industry  applications. 
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The  main  elements  of  time  management  in  HLA  are:  a)  a  Logieal  Timeline,  b)  Time  ordered  de¬ 
livery  of  interactions  between  simulations,  and  c)  a  protocol  for  advance  of  Logical  Time.  In  a 
causality  preserving  execution  (note  that  HLA  supports  untimed  executions  as  well),  the  underly¬ 
ing  RTI  maintains  a  logical  time,  and  interaction  messages  generated  by  simulations  are  time 
stamped  with  the  logical  time  and  delivered  to  their  destinations  in  a  timed  order.  The  logical 
time  is  advanced  by  a  cooperative  Time  Advance  Request  and  Grant  protocol.  A  similar  protocol 
is  supported  for  event  driven  simulation  in  which  the  event  driven  simulation  requests  the  Next 
Event  to  the  RTI.  The  simulation  logical  time  is  advanced  either  to  the  earliest  available  interac¬ 
tion  or  to  the  time  stamp  of  the  next  event  local  to  the  requesting  simulation 
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Fig.  1 :  The  C2WT  architecture 
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Modeling  and 
Simulating  Terrorist 
Rletmrorks  in  Social 
and  Geospatial 
Dimensions 


Il-Chul  Moon  and  Kathleen  M.  Carley,  Carnegie  Mellon  University 


Where  we  are  influences  who  we  know,  and  vice  versa.  As  we  move  to  new 
cities  or  countries,  our  contacts  change.  For  instance,  when  a  company  relo- 


A  simple  theoretical 
multiagent  model 
reasons  about 
the  criticality 
of  terrorists  and 
regions  as  terrorist 
interactions  coevolve 
in  geographical 
and  social  spaces. 


cates  its  employees,  they  develop  new  working  relations  with  others  while  they  per¬ 
form  assigned  tasks.  In  theory,  these  relocations  should  improve  company  performance.^ 


However,  performance  also  depends  on  individuals 
knowing  who  to  ask  about  what — that  is,  on  trans¬ 
active  memory.^  Moving  disrupts  transactive  mem¬ 
ory  and  the  social  relations  by  which  information 
flows.  So,  the  question  arises  whether  performance 
can  improve  when  social  and  geospatial  distribu¬ 
tions  change  simultaneously. 

Social  and  spatial  relations  evolve  over  time.  Esti¬ 
mating  their  evolutions  is  important  for  management, 
command  and  control  structures,  and  intelligence 
analysis  research.  By  knowing  future  agent  social 
and  spatial  distributions,  an  analyst  can  identify 
emergent  leaders,  hot  spots,  and  organizational  vul¬ 
nerabilities.  Historically,  such  estimations  have 
depended  heavily  on  qualitative  data  analyses  by 
subject-matter  experts.^  A  few  researchers  ap¬ 
proached  the  issue  using  multiagent  models  and  sim¬ 
ulation.  The  models  addressed  the  complex  nature 
of  the  organization  and  task  assignments,  resource 
distributions,  or  agent  locations.  The  simulations 
addressed  the  near-term  organizational  changes.  This 
research  came  from  two  perspectives:  the  effects  of 
change  in  the  social  network^’^  and  the  effects  of 
geospatial  change.^’^  Both  perspectives  can  project 
aspects  of  emerging  organizational  structure  and 
future  performance,  but  they  can’t  examine  the  inter¬ 
action  between  physical  and  social  movements. 

We’ve  developed  a  simple  theoretical  multiagent 


simulation  model  to  show  how  changes  in  the  coevo¬ 
lution  of  social  and  geospatial  dimensions  affect 
group  behavior.  Our  model  overcomes  the  limitations 
of  isolated  social  and  spatial  models  (see  the  “Related 
Work  in  Social  and  Geospatial  Modeling”  sidebar). 
To  illustrate  the  model’s  potential  for  reasoning,  we 
examine  its  implications  here  for  a  real-world  terror¬ 
ist  network,  using  data  extracted  from  open  source 
texts.  Although  a  full  validation  would  require  addi¬ 
tional  field  data,  the  model’s  output  reveals  impor¬ 
tant  aspects  of  complex  organizational  evolution  that 
apply  beyond  the  counterterrorism  domain. 

Input  data  set 

The  model’s  input  is  a  network  representation  of 
an  organizational  structure  in  the  social  and  geospa¬ 
tial  dimensions.  It  includes  knowledge  and  task 
information:  who  knows  what  and  who  is  using  that 
knowledge.  For  the  terrorist  network,  we  extracted 
relevant  data  from  unclassified  documents,  using  the 
AutoMap  text  analysis  tool.^  The  documents  in¬ 
cluded  newspaper  articles  and  unclassified  intelli¬ 
gence  reports  from  subject-matter  experts.  We  hand- 
coded  the  corresponding  latitudes  and  longitudes  for 
the  relevant  data. 

Figure  la  is  an  overall  visualization  of  the  result¬ 
ing  network  consisting  of  four  node  types:  agents, 
knowledge,  tasks,  and  locations;  figure  lb  is  a 
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Figure  1.  (a)  The  overall  visualization  of  the  example  terrorist  network  represents  agents,  knowledge  bits,  tasks,  and  locations  as 
red,  yellow,  blue,  and  orange  nodes,  respectively,  (b)  The  agent-to-agent  network  of  the  data  set  consists  of  three  disconnected 
subnetworks. 


Figure  2.  (a)  Agent-to-location  network.  The  red  nodes  represent  agents;  the  orange  nodes  represent  agent  locations,  which 
include  latitude  and  longitude  coordinates,  (b)  The  AL  network  overlaid  on  a  world  map.  To  suggest  how  many  agents  are 
clustered  at  a  specific  location,  the  different-sized  squares  correspond  to  the  number  of  agents  in  different  regions.  The  blue 
edges  display  the  agent-to-agent  network  links. 


visualization  of  the  data  set’s  agent-to-agent  (AA)  links.  Table  1 
shows  the  input  network’s  adjacency  matrix,  or  metamatrix,  across 
these  nodes.  This  multimode,  multilink  network  data  represents  the 
organization’s  current  structural  characteristics  in  our  model. 

We  model  the  social  dimension  by  using  an  algorithm  that  specifies 
the  interaction  probability  between  two  agents.  We  model  the  geospa¬ 
tial  dimension  by  using  an  agent-relocation  mechanism  that  interprets 
agent  movement  in  a  geospatial  location  network’s  data  set.  For 
instance,  if  two  agents  have  interactions  or  formal  relations,  we  assume 


that  an  AA  link  exists  between  them.  Similarly,  if  an  agent  possesses 
a  knowledge  bit,  we  assume  an  agent-to-knowledge  (AK)  link  between 
the  nodes.  If  two  locations  appear  in  the  same  context,  we  regard  the 
two  locations  as  related  (LL).  This  topological  location  network  con¬ 
stitutes  the  agent-relocation  dimension.  The  other  subnetworks,  such 
as  an  agent-to-task  network,  knowledge- to-location  network,  and  task- 
to-location  network,  have  their  own  intuitive  meanings  based  on  the 
connected  node  types  and  the  data  coder’s  perspective. 

Figure  2a  shows  the  agent-to-location  (AL)  network;  figure  2b 
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Reloted  NorR  in  Social  and  Geospatial  Nodelino 


Researchers  who  study  people's  movements  concurrently 
through  social  relations  and  space  mainly  use  two  techniques: 
data  mining  and  simulation.  Data  mining  can  uncover  patterns 
such  as  an  organization's  network  structure,  entity  properties, 
and  entity  clusters.  For  instance,  in  a  summary  of  data  mining's 
impact  on  the  counterterrorism  community,  Jeff  Jonas  and  Jim 
Harper  claim  that  the  9/1 1  attack  plan  was  available  before  the 
attack.^  Uncovering  the  plan  would  have  required  extensive 
data  mining  on  available  databases,  but  the  US  government 
might  have  disrupted  the  plan  by  pursuing  available  leads.  Al¬ 
though  the  authors  make  a  counterterrorism  case  for  data 
mining,  they  also  note  that  high  false  positives,  or  incorrect 
predictions,  could  waste  valuable  resources. 

Link  analysis  and  discovery  is  another  data  mining  technique 
applied  to  counterterrorism.  Raymond  Mooney  and  his  col¬ 
leagues  use  it  with  an  inductive-logic-programming  method  to 
discover  implied  rules  in  multirelational  data.^  They  describe  a 
powerful  tool  for  approximating  a  complete  organizational 
network  from  an  incomplete  one. 

Vandana  R  Janeja,  Vijayalakshmi  Atiuri,  and  Nabil  R.  Adam 
focus  a  modeling  and  simulation  approach  to  detecting  anom¬ 
alous  geospatial  trajectories  on  the  basis  of  spatiosemantic  as¬ 
sociations.^  They  create  basic  spatial  analysis  units,  or  spatial 
units,  and  cluster  them  into  a  microneighborhood  that  shares 
similar  characteristics  across  subspatial  units.  Their  analysis  of 
spatial  and  social  characteristics  at  the  same  time  is  similar  to 
our  correlation  between  spatial  and  social  dimensions. 

Hsinchun  Chen,  Fei-Yue  Wang,  and  David  Zeng  describe  the 
development  of  an  intelligence  and  informatics  security  model 
that  depends  heavily  on  network  and  link  analysis.^  They  ex¬ 
amine  three  interesting  uses  of  the  model:  cross-jurisdiction 
information  sharing,  terrorism  information  collection,  and 
smart-border  and  bioterrorism  applications.  One  of  their  appli¬ 
cations,  the  West  Nile  Virus-Botulism  Portal,  includes  hot-spot 
analysis  and  a  prediction  function. 

Organizational-behavior  research  has  benefited  from  agent- 
based  modeling  techniques.  For  instance,  Kathleen  Carley  has 
made  the  efforts  to  model  sociotech nica I  systems  as  networked 
multiagent  structures.^  She  introduces  exemplary  multiagent 
models  such  as  OrgaHead®  and  Construct.^  These  models  take 
networked  organizational  structures  as  an  input  and  generate 


the  estimated  performance  of  task  accuracy  and  information 
diffusion  over  time  as  well  as  the  evolved  structures  after  simu¬ 
lation.  This  approach  might  be  difficult  to  validate,  but  it  rep¬ 
resents  an  effort  to  create  more  complex,  realistic  models  that 
can  automatically  generate  hypotheses  forecasting  organiza¬ 
tional  behavior.^  Researchers  could  then  use  these  hypotheses 
to  estimate  domain  features  or  trends  of  interest  and  sub¬ 
sequently  use  other  statistical  analysis  tools,  such  as  data  min¬ 
ing,  to  validate  the  hypotheses. 
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Table  1 .  A  metamatrix  of  the  input  data  set 
for  a  terrorist  network  organizational  structure.* 


Nodes 

Agent 

Knowledge 

Task 

Location 

Agent  (916) 

Social  network 

Knowledge  network 

Assignment  network  Deploy  network 

(AA,  0.0024) 

(AK,  0.0093) 

(AT,  0.0070) 

(AL,  0.0026) 

Knowledge 
(614  bits) 

Not  used 

Needs  network 
(KT,  0.0961) 

Regional 

knowledge  network 
(KL,  0.0692) 

Task  (258) 

— 

— 

Not  used 

Regional  task 
network 
(TL,  0.1042) 

Location 

(387) 

— 

— 

— 

Proximity  network 
(LL,  0.0799) 

*The  number  of  nodes  and  network  densities  are  in  parentheses. 


overlays  it  on  a  geographic  map.  Details  on 
the  coding  process  are  available  elsewhere.^ 

Model  summary 

The  model  simulates  each  agent  and  its 
interaction  with  others  to  estimate  changes 
over  time  in  organizational  performance  and 
structure.  As  agents  interact  and  learn,  their 
behavior  eventually  changes  the  perfor¬ 
mance  and  structure.  The  following  algo¬ 
rithm  outlines  the  interaction  and  relocation 
mechanisms  for  agent  A’s  behavior: 

1.  A  searches  for  locations  within  its  vi¬ 
sion  range  (VR),  looking  for  unknown 
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Table  2.  Model  input,  output,  parameters,  and  internal  variables.* 


Type 

Name 

Implication 

Input 

A  networked  organizational  structure 

A  network  inciuding  agents,  knowiedge  bits,  tasks,  and  iocations.  The 
network  represents  the  target  domain’s  compiex  organizationai  structure. 

Output 

An  evolved  network  organization 

A  network  organization  with  a  recreated  agent-to-agent  (AA)  network  and 
an  agent-to-iocation  (AL)  network,  both  of  which  refiect  interactions  and 
reiocations. 

Knowiedge  diffusion 

A  performance  metric  showing  how  fast  information  can  diffuse  across  the 
network. 

Energy  task  accuracy 

A  performance  metric  showing  how  accurateiy  information  is  distributed 
to  agents  who  require  it  to  compiete  their  tasks. 

Gini  coefficient  for  AA  and  AL 

Coefficients  indicating  the  extent  of  unequai  distribution  of  AA  and  AL 
network  criticaiities. 

Parameters 

Simuiation  runtime  step  (defauit  =  30  steps) 

The  totai  simuiation  runtime. 

Number  of  repiications  (defauit  =  3) 

The  number  of  modei  runs  (required  because  the  modei  is  stochastic,  not 
deterministic). 

Move  radius  (MR) 

The  radius  on  the  spatiai-route  network  specifying  the  maximum  distance 
an  agent  can  move  in  one  time  step. 

Vision  range  (VR)  (defauit  =  1) 

The  range  on  the  spatiai-route  network  specifying  an  agent’s  abiiity  to  gather 
a  knowiedge  bit  or  interact  with  another  agent. 

Sphere  of  infiuence  (SI)  (default  =  2) 

The  number  of  sociai  iinks  that  an  agent  can  cross  for  an  interaction. 

Relative-similarity  (RS)  weight,  wy,  reiative- 
expertise  (RE)  weight,  W2,  sociai-distance  (SD) 
weight,  n/3  (defauit  =  0.5);  and  spatiai-proximity 
(SP)  weight,  W4  (defauit  =  0.5) 

The  weights  to  caicuiate  four  interaction  probabiiities. 

Learning  rate  from  an  agent  (defauit  =  0.05) 

The  possibiiity  that  an  agent  can  iearn  a  knowiedge  bit  from  an  interaction 
with  another  agent. 

Learning  rate  from  a  iocation  (defauit  =  0.025) 

The  possibiiity  that  an  agent  can  gather  a  knowiedge  bit  by  observing  a 
knowiedge  node  within  vision  range. 

Internal 

variables 

Reiative  simiiarity  (RS,y) 

The  iikeiihood  of  interactions  caused  by  homophiiy  between  /  and  /  (passive 
information  seeking). 

Reiative  expertise  (RE^) 

The  iikeiihood  of  interactions  caused  by  expertise  between  /  and  /  (active 
information  seeking). 

Sociai  distance  (SD,y) 

The  iikeiihood  of  interactions  over  muitipie  sociai  iinks. 

Spatiai  proximity  (SP^) 

The  iikeiihood  of  interactions  from  spatiai  distance. 

Interaction  candidate  set  (ICS/) 

The  agent  set  with  which  agent  /  can  interact. 

Probability  of  interaction  ) 

The  iikeiihood  of  agent  /s  interaction  with  agent  /,  caicuiated  as  the  weighted 
iinear  sum  of  RS,  RE,  SD,  and  SP. 

Probabiiity  of  reiocation  ) 

The  iikeiihood  of  agent  /s  moving  to  iocation  i,  determined  by  the  number  of 
avaiiabie  knowiedge  bits  required  to  perform  the  agent’s  assigned  tasks. 

*  We  use  model  default  values  here  except  tor  the  move  radius  (MR),  relative-similarity  weight  (1/1/1),  and  relative-expertise  weight  (1/1/2). 


but  necessary  knowledge  bits. 

2.  A  moves  to  a  found  location. 

3.  A  learns  the  unknown  knowledge  at  its  location. 

4.  A  selects  an  agent  from  those  that  qualify  as  communication 
candidates. 

5.  A  exchanges  the  unknown  knowledge  with  the  selected  agent. 

Basically,  agents  can  interact  and  relocate  at  each  simulation  time 
step.  They  select  a  location  to  move  to  and  an  agent  to  interact  with 
according  to  probabilistic  values  for  each  interaction  and  relocation 
opportunity.  Exactly  which  agents  interact  with  which,  when  they 
interact,  what  choices  they  make,  and  what  they  communicate  and 
learn  are  defined  probabilistically.  Consequently,  the  model  is  sto¬ 


chastic  and,  as  such,  requires  multiple  replications  to  generate  stable 
results  and  to  define  the  space  of  outcomes. 

Table  2  lists  several  factors  that  drive  an  agent’s  behavior  and  so  the 
network’s  evolution  and  organization’s  structure.  For  example,  agent 
behavior  depends  on  the  given  input  data  set,  which  sets  the  initial  envi¬ 
ronment.  The  input  determines  the  initial  probability  of  interaction 
among  agents  according  to  what  they  know  and  where  they  are  located. 
The  model’s  parameters  include  the  relocation  (move)  radius  in  the 
geospatial  dimension,  the  interaction  (sphere  of  influence)  radius  in 
the  social  dimension,  and  the  probability  of  learning  after  a  knowledge 
exchange  with  an  agent  or  a  knowledge  gathering  at  a  certain  location. 
Finally,  the  internal  variables  reflect  behaviors  calculated  from  the 
defined  inputs  and  parameters,  according  to  various  model  formulas. 
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We  tested  this  model  by  varying  important  parameters  in  the  agent 
interactions  and  relocations.  First,  we  changed  the  agent  move  radius 
(MR)  by  0, 1,  and  2.  If  an  agent’s  MR  is  0,  it’s  stationary  to  its  initial 
location.  If  its  MR  is  2,  the  agent  can  search  locations  linked  by  two 
LL  links  from  its  initial  location.  Next,  we  varied  the  weight  of  rela¬ 
tive  similarity  (RS)  and  relative  expertise  (RE)  contributing  to  the 
probability  interaction.  If  the  RS  weight  is  high,  the  agents  interact 
mainly  with  agents  sharing  similar  backgrounds,  beliefs,  and  knowl¬ 
edge.  This  imitates  agents  as  passive  information  receivers.  In  con¬ 
trast,  a  higher  RE  weight  makes  the  agents  active  information  seek¬ 
ers.  Einally,  we  tested  the  input  data’s  sensitivity  by  randomly  dropping 
or  adding  links  in  the  A  A  or  LL  networks. 


Social  distance.  SD  is  another  factor  affecting  agents’  probability  of 
interaction — if  two  agents  must  cross  many  social  links,  then  the 
probability  should  be  low,  and  vice  versa.  We  compute  it  by  find¬ 
ing  the  shortest  path  between  two  agents  and  then  dividing  one  by 
the  number  of  links  in  that  path. 


5Z),= 


\AA„ 


\AAij\  =  \ 


No.  of  links  on  shortest  path  from  i  to  j 
(no.  of  links  <  SI) 

SI  -I- 1  (no.  of  links  >  SI) 


(2) 


Agent-interaction  mechanism 

Agents  have  the  opportunity  to  interact  during  each  time  period. 
They  select  an  agent  to  interact  with  according  to  a  probability  of 
interaction,  P,  that’s  a  weighted  sum  of  four  different  factors:  RS,  RE, 
social  distance  (SD),  and  spatial  proximity 
(SP).  The  theory  for  these  factors  comes  from 
sociology,  communication  theory,  and  coun¬ 
terterrorism  analysis. 

Because  the  model  is  stochastic,  an  agent 
will  usually  interact  with  agents  that  it  has  a 
higher  probability  of  choosing  but  will  occa¬ 
sionally  end  up  with  a  less  likely  choice.  Like 
humans,  these  simulated  agents  can’t  always 
talk  to  their  first  choice.  The  model  thus  cap¬ 
tures  interactions  that  reflect  less-than-optimal 
connections  between  intention  and  action  as 
well  as  the  rare  unexpected  interaction. 

After  an  agent  chooses  another  agent  to 
interact  with,  the  two  agents  will  exchange 
knowledge  bits.  Eor  each  exchanged  knowl¬ 
edge  bit,  the  model  draws  a  number  from  a 
uniform  distribution  ranging  from  0  to  1 .  If  the  number  is  within  the 
receiving  agent’s  learning  rate,  that  agent  will  have  a  new  link  to  the 
communicated  knowledge  piece  in  the  AK  network. 


If  SD  is  larger  than  the  maximum  number  of  links  in  the  sphere  of 
influence,  SI,  then  SD  is  set  to  one  plus  the  maximum  for  social- 
interaction  perimeter  modeling.  An  agent  can  recognize  and  distin¬ 
guish  the  closeness  of  other  agents  within  the  SI  perimeter,  but  it 
can’t  differentiate  the  closeness  when  the 
interacting  agent  is  outside  the  perimeter.  In 
this  case,  an  agent  regards  the  interacting 
agents  as  just  SI  -h  1  links  away,  though  the 
real  SD  might  differ. 

Spatial  proximity.  Intuitively,  two  persons  at 
the  same  location  are  more  likely  to  talk  than 
are  two  at  different  locations.  Some  might 
argue  that  SP  isn’t  significantly  correlated 
with  interaction  frequency  in  the  Internet  age. 
However,  in  the  terrorism  domain,  attending 
the  same  training  camp  or  the  same  mosque 
is  a  critical  interaction  indicator.  The  SP 
model  is  similar  to  SD  but  indicates  the  prob¬ 
ability  of  being  at  the  same  location,  rather 
than  having  a  social  link: 

\ 


llgenlshove  Ihe  opporlunilylo 
inlerocl  during  eoch  lime  period 
Theq  select  on  ogenlloinlerocl 
ujilh  according  looprobobililg 
ofinlerocNonlbofsoiueigbled 
sum  of  four  different  factors. 


SR,  = 


Relative  similarity  and  relative  expertise.  RS  is  a  ratio  reflecting 
similarity  in  the  choosing  and  chosen  agents’  knowledge.  It’s  based 
on  the  sociological  principle  of  homophily}^  which  describes  the 
increased  likelihood  of  a  person  interacting  with  another  person  who 
shares  similar  education,  beliefs,  or  race.  RS  represents  the  proba¬ 
bility  of  a  terrorist  interacting  with  other  terrorists  that  share  the  same 
religion  or  nationality.  RE  is  a  ratio  reflecting  the  amount  of  knowl¬ 
edge  the  chosen  agent  has  that  the  chooser  doesn’t  have,  and  it’s  based 
on  transactive  memory.^  RE  captures  why  a  Middle  Eastern  terrorist 
interacts  with  a  South  American  drug  cartel  to  exchange  weapons 
expertise  or  information  about  funding  sources.  At  first  ghmpse,  the  two 
factors  might  seem  contradictory,  but  they’re  just  two  metrics  captur¬ 
ing  different  aspects  of  terrorist  knowledge-acquisition  attitudes: 

K  K 


No.  of  links  on  shortest  path  from  to  I2 
(no.  of  links  <  VR) 

YR  +  \  (no.  oflinks>VR) 


As  with  SD,  if  SP  is  greater  than  VR,  which  is  a  maximum  communi¬ 
cation  range  across  the  geospatial  dimension,  and  chosen  by  the  user, 
the  model  sets  SP  to  one  plus  the  maximum  for  computing  conve¬ 
nience.  The  rationale  for  using  VR  in  the  geospatial-domain  calcula¬ 
tion  is  the  same  as  the  rationale  for  using  SI  in  the  social  dimension. 


Probability  of  interaction.  Using  the  four  different  factors  we’ve 
described,  we  can  express  the  probability  that  agents  will  select 
another  agent  to  interact  with  as  a  weighted  sum: 


lAK,kAK,, 


k=o 


RS,=^  , 


,REi,  = 


k^O 


(1) 


[nteraction  _ 


=  WiRSjj  +  W2REjj  +  w^SDjj  +  tv^SPjj 


(4) 


^-0  ^=0 


where  K  is  the  number  of  knowledge  bits. 


Although  the  model  can  calculate  the  probability  for  any  pair  of 
agents,  we  limit  the  number  of  possible  interaction  candidate  agents 
according  to  two  distances,  SD  and  SP.  This  restriction  assumes  that 
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Table  3.  Virtual-experiment  design:  Sensitivity  analysis  and  parameter-space  exploration. 


Input  parameters 

Value 

Implication 

Move  radius  (MR) 

0, 1,  or  2  (3  cases) 

Parameter-space  expioration,  examining  the  resuits’  sensitivity  according  to  the 
agent-movement  perimeter  (MR  parameter) 

Weights  for  RS  (i/i/i)/RE  (n/2) 

0/1,0.25/0.75,0.6/0.4, 
0.75/0.25,1/0  (5  cases) 

Parameter-space  expioration,  examining  the  agent-interaction  attitudes  and  their  affect 
on  the  resuits,  from  passive  information  gathering  to  active  information  gathering 

Density  of  the  organizationai- 
structure  network  (AA  and 

LL  densities) 

75%,  100%,  125%  (3  cases) 

Sensitivity  anaiysis,  examining  the  sensitivity  of  resuits  according  to  the  density 
changes  of  the  AA  and  LL  networks  corresponding  to  the  sociai  and  geospatiai 
dimensions,  respectiveiy 

Totai  virtuai  experiment  ceiis 

45  ceiis  (3x5x3  cases) 

— 

a  person  will  interact  with  others  in  his  or  her  neighborhood — either 
social  or  geographic.  Formally,  the  model  defines  the  interaction  can¬ 
didate  set  as 

IC5,.  ={A,.|(|AA,^|<5/)v(|LLyjAL,,  AL,,^  <  VJ?)}  (5) 

An  agent  can  communicate  only  with  its  candidate  agents,  so  the 
probability  of  interaction  is  calculated  between  each  agent  and  its 
candidate  agents. 


as  follows: 


KD  = 


A  K 


11 

i^O  j^O 


KxA 


(7) 


But  KD  considers  only  who  knows  what.  ETA  calculates  the  extent 
to  which  the  agents  have  the  knowledge  they  need  to  do  their  assigned 
tasks.  This  calculation  introduces  the  agent- to-task  (AT)  and  knowl- 
edge-to-task  (KT)  networks: 


Agent-relocation  mechanism 

Our  model  lets  agents  relocate  themselves  to  adjacent  locations. 
The  MR  parameter  defines  the  sphere  of  relocation,  but  the  proba¬ 
bility  of  choosing  a  certain  location  is  more  complicated: 


pRelocation  _ 


1 


\KLu 


No.  of  links  on  shortest  path  from  I  to  k 
<  (no.  of  links  <  VR)  ^ 

VR  -I- 1  (no.  of  links  >  VR) 


(6) 


In  essence,  the  agents  choose  a  location  that,  on  average,  guarantees  the 
shortest  path  to  their  required  knowledge  bits.  In  other  words,  the  agents 
try  to  put  themselves  at  the  optimal  location  to  collect  the  knowledge 
they  want.  However,  like  the  AA  interaction  model,  this  is  a  stochas¬ 
tic  model  that  determines  location  choices  probabilistically.  So,  it’s 
possible  to  choose  a  nonpreferred  location  with  lower  probability. 

After  selecting  a  location,  the  model  changes  the  AL  network  by 
removing  the  edge  from  the  agent  to  the  old  location  and  adding  an  edge 
to  the  new  location.  Additionally,  the  agent  will  gather  knowledge  bits 
linked  to  locations  in  its  VR.  This  knowledge  gathering  is  similar  to  the 
knowledge  exchange  between  agents,  except  it  uses  a  different  learn¬ 
ing  rate.  Some  might  argue  that  this  regional  knowledge  acquisition 
isn’t  necessarily  tme,  especially  in  the  real  world  where  terrorists  can 
learn  new  knowledge  from  Web  sites.  However,  many  terrorists  go  to 
training  sites  and  organization  headquarters  to  receive  specific,  detailed 
training.  These  relocations  are  an  important  issue  in  the  counterterror¬ 
ism  field, and  we’re  specifically  examining  them  in  this  example. 


Output  measures 

We  use  two  performance  metrics  to  evaluate  an  evolving  orga¬ 
nization  over  time:  knowledge  diffusion  and  energy  task  accuracy. 
KD  gauges  the  dispersion  of  the  knowledge  bits  across  the  agents 


K  (  A  ^ 

ETA  =  —  J^^ - 2^ - ^ 

y  ^  A  K 


a^O 


k^O 


(8) 


Furthermore,  we  define  two  criticality  metrics  for  the  agents  and 
locations.  For  agents,  we  count  the  number  of  agents  that  an  agent 
interacts  with  during  the  simulation.  This  represents  the  number  of 
agents  that  the  agent  knows  and  influences.  For  locations,  we  count 
the  number  of  agents  in  a  location  at  the  end  time.  If  the  location  har¬ 
bors  more  agents,  it  might  have  higher  terrorist  activities. 


Results 

We  used  the  model  to  analyze  the  terrorist  network  in  the  meta¬ 
matrix  format  (see  table  1)  and  to  generate  estimates  on  agent  relo¬ 
cation,  geospatial  clustering,  agent  interaction,  and  social-network 
evolution.  We  performed  a  sensitivity  analysis  first,  then  visualized 
and  analyzed  the  model  output  in  two  dimensions. 

We  replicated  the  simulation  three  times  for  30  simulation  time 
steps.  The  sensitivity  analysis  showed  significant  p-values  for  some 
independent  factors.  Specifically,  MR  is  a  significant  predicting  fac¬ 
tor  for  ETA,  KD  and  the  Gini  coefficient  are  significant  for  location- 
criticality  distribution,  and  RS  is  important  for  explaining  the  Gini 
coefficient  of  the  agent-criticality  distribution.  (The  Gini  coefficient 
comes  from  economics  and  describes  a  property’s  distribution  across 
a  population.)  These  p-values  indicate  that  three  replications  are  suf¬ 
ficient  for  identifying  the  critical  factors  for  each  performance  met¬ 
ric.  The  stabilized  distribution  of  the  results  requires  further  exami¬ 
nation,  but  that  work  is  outside  this  article’s  scope. 


Sensitivity  analysis 

We  analyzed  the  model’s  sensitivity  by  varying  the  input  parame¬ 
ters  in  table  3.  After  running  the  model  with  varied  parameters,  we 
performed  a  regression  analysis.  The  independent  variables  are  the 
varied  parameters  of  a  virtual-experiment  cell — for  example,  a  com- 
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Table  4.  Regression  for  sensitivity  analysis. 


Dependent  variable 

Energy  task  accuracy 

Knowledge  diffusion 

Gini  coefficient  of  location- 
criticality  distribution 

Gini  coefficient  of  agent- 
criticality  distribution 

Standardized  coefficients 

Move  radius 

0.748* 

0.780* 

-0.956* 

-0.088 

Reiative  simiiarity 

0.008 

0.004 

0.020 

o.isit 

Possibie  density 

0.010 

0.009 

-0.114* 

-0.865* 

Adjusted  R-square 

0.506 

0.555 

0.925 

0.765 

*p-value  <  0.001 
Ip-value  <  0.01 


Figure  3.  The  agent  geospatial  distribution  changes  over  time  with  a  move  radius  of  1: 
(a)  the  distribution  at  time  0,  (b)  the  distribution  at  time  30.  The  size  of  the  squares 
corresponds  to  the  number  of  agents  in  the  region,  and  the  lines  are  the  interlocation 
agent-to-agent  communication  links. 


bination  of  0  MR,  0/1 RS/RE  ratio,  and  75  per¬ 
cent  density  rate.  The  dependent  variables  are 
the  two  performance  metrics  and  the  Gird  coef¬ 
ficients  of  the  agent-  and  location-criticality 
distributions. 

Table  4  is  the  regression-analysis  result. 
First,  as  MR  increases,  the  network’s  per¬ 
formance  improves.  The  terrorists  in  the 
model  tend  to  relocate  to  regions  where  they 
can  collect  more  information,  rather  than  stay 
in  their  current  location.  Furthermore,  these 
relocations  increase  task  performance  by 
increasing  the  information  feed.  Next,  higher 
MR  and  higher  possible  density  decreases 
the  Gini  coefficient  of  location  criticalities. 
This  indicates  that  terrorists  will  disperse 
more  if  they  can  relocate  more  easily  and  the 
input  network  is  denser.  Finally,  lower  RS 
will  induce  a  more  centralized  terrorist  net¬ 
work.  Particularly,  the  input  network  density 
has  a  great  impact  on  the  agent-criticality  dis¬ 
tribution  compared  with  its  impact  on  the 
location-criticality  distribution. 

Location-criticality  analysis 

Agent  movement  creates  segregation  pat¬ 
terns  over  time  (see  figure  3).  Figure  4  shows 
an  accumulated  agent  distribution  across  the 
locations.  The  distribution  implies  that 
agents  will  disperse  more  if  we  increase  MR: 
the  fewer  places  harboring  terrorists,  the 
greater  the  MR,  which  should  help  the  ter¬ 
rorists  find  the  places  to  cluster.  However, 
our  model  indicates  the  opposite  scenario: 
the  terrorists  in  our  model  can’t  find  the 
places  to  cluster  densely.  Rather  than  gath¬ 
ering  in  a  few  regions,  the  terrorists  will  dis¬ 
perse  around  the  world. 

Table  5  lists  the  top  10  locations  harboring 
terrorists  after  the  simulations.  Although  the 
accumulated  distribution  and  its  Gini  coeffi¬ 
cient  in  figure  4  showed  terrorist  dispersion, 
the  top  10  locations  are  fairly  consistent 
across  three  different  MR  levels.  This  implies 
that  the  hot  regions  with  frequent  terrorist 
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Figure  4.  An  accumulated  distribution  of  agents  across  the  locations.  The 
whereabouts  of  570  agents  are  known,  and  there  are  387  locations. 


Table  5.  The  top  10  critical  locations. 


Rank 

MR  =  0  (stationary) 

MR  =  1  (adjacent  move) 

MR  =  2  (farther  move) 

1 

US 

US 

US 

2 

Israel 

France 

France 

3 

France 

Morocco 

Morocco 

4 

Bali 

Israei 

Casabianca 

5 

Morocco 

Baii 

Baii 

6 

Egypt 

Casabianca 

Egypt 

7 

Afghanistan 

Egypt 

Israei 

8 

Casabianca 

Iraq 

Strasbourg 

9 

Iraq 

Indonesia 

Gaza 

10 

Indonesia 

Strasbourg 

Indonesia 

activity  will  remain  at  the  top  after  the  relo¬ 
cations,  even  though  some  terrorists  in  those 
regions  move  to  regions  with  less  activity.  In 
detail,  the  northwest  African  regions — that 
is,  Morocco  and  Casablanca — become  im¬ 
portant  locations  as  well  as  some  European 
regions,  such  as  France.  The  south  Asian 
regions  of  Indonesia  and  Bali  and  the  areas  of 
frequent  activity — US  and  Israel — will  re¬ 
main  the  same. 

Agent-criticality  analysis 

We  analyzed  the  important  agents  after  the 
simulation.  According  to  the  sensitivity  an¬ 
alysis,  RS  changes  impact  the  distribution  of 
the  agent  criticality.  Figure  5  visualizes  the 
accumulated  agents’  social  link  coverage  ac¬ 
ross  the  RS  levels.  It  shows  some  slight  dif¬ 
ferences  in  terms  of  Gini  coefficients,  but  the 
link-coverage  distribution  doesn’t  change 
much.  This  implies  that  the  terrorist  social 
network’s  evolution  is  stable  regardless  of 
the  parameter  change.  In  spite  of  the  small 
changes,  the  increase  in  Gini  coefficient  with 
higher  RS  suggests  that  fewer  terrorists  will 
control  the  social  links  if  the  terrorists  gather 
information  more  passively.  For  instance, 
one  terrorist  group  often  has  different  back¬ 
grounds  from  another  group.  In  that  case, 
under  a  strong  RS  interaction  weight,  only 
terrorists  with  backgrounds  similar  to  both 
groups  will  be  able  to  communicate  with  the 
groups’  members.  A  strong  homophily  trend 
means  that  agents  will  have  fewer  possible 
agents  within  their  ICS  and  that  fewer  agents 
will  control  more  social  links. 

As  with  location-criticality  analysis,  we 
identified  the  top  10  terrorists  who  control 
the  most  links  after  simulation.  Table  6 
shows  that  the  top  terrorists,  such  as  Bin 
Laden  and  Riduan  Isamuddin,  have  similar 
power  after  simulations  in  spite  of  varying 
parameters.  This  is  because  they’re  already 
the  center  of  terrorist  social  networks,  so  they 
appear  frequently  in  ICSs.  Additionally,  they 
have  fairly  comprehensive  backgrounds  and  knowledge,  so  most 
agents  can  find  high  RS  and  RE  with  the  top-ranking  agents.  On  the 
other  hand,  Mohammad  Atta  shows  higher  ranks  under  the  passive- 
information-gathering  assumption,  because  his  background  was  com¬ 
mon  across  the  agents. 


Our  analysis  indicates  that  the  agents  become  more  dispersed 
around  the  world  but  that  critical  agents  themselves  don’t 
change  much.  Obviously,  the  analysis  method  has  its  limitations. 
First,  validating  the  simulation  model  is  very  challenging  and  involves 
open  research  questions,  such  as  matching  the  simulated  time  step 


to  the  real-time  flow.  Also,  incorrect  input  data  sets  can  misdirect  the 
model’s  output.  Complete  and  correct  real-world  data  sets  are  rare, 
but  we  expect  to  resolve  some  concerns  by  adding  more  realistic 
agent-behavior  mechanisms.  As  the  subjects’  behaviors  become  more 
complex,  adding  more  salient  features  to  the  model  will  increase  its 
usability.  A  recent  book  addresses  defense  modeling,  simulation,  and 
analysis  issues  further. 

Despite  some  concerns,  this  complex  multiagent  model  generates 
several  estimates  that  are  useful  for  policy  making  and  theory  building. 
Furthermore,  the  formula-based,  agent-behavior  design  can  be  updated 
easily  as  findings  from  other  disciplines  become  available.  These  two 
points  provide  incentives  for  using  the  model  in  the  real  world  and  for 
updating  and  developing  it  on  the  basis  of  future  findings.  H 
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Figure  5.  The  accumulated  distribution  of  the  percentage  of  covered  social  links  across 
the  agents. 


Table  6.  The  top-10  critical  agents. 


Rank 

RS  =  0.0  (active 
information  gathering) 

RS  =  0.6 

RS  =  1.0  (passive 
information  gathering) 

1 

Bin  Laden 

Bin  Laden 

Bin  Laden 

2 

Riduan  Isamuddin 

Riduan  Isamuddin 

Riduan  Isamuddin 

3 

Abdul  Aziz 

Abdul  Aziz 

Mohammed  Atta 

4 

Yasser  Arafat 

Yasser  Arafat 

Bakar  Bashir 

5 

Bakar  Bashir 

Yaacov  Perry 

Yasser  Arafat 

6 

Mohammed  Atta 

Mohammed  Atta 

Zacarias  Moussaoi 

7 

Yaacov  Perry 

Bakar  Bashir 

Yaacov  Perry 

8 

Imam  Samudra 

Zacarias  Moussaoui 

Abdul  Aziz 

9 

Zacarias  Moussaoui 

Mohambedou  Slab 

Yazid  Sufaat 

10 

Abdullah  Sungkar 

Abdullah  Sungkar 

Mohambedou  Slab 
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KejTi'oi'd^:  ioffuence  net.  activation  limed  infl-ueuce  net.  Bayedan  net 
Received:  October  12,  200 S 

A  evolution  of  octfomj,  in  conjunction  with  the preconditio?Js  of§]efr  efivit'onmefjt  and  their 

ejf^ts,  are  ail  depicted  by  Aettvation  Timed  Injluefi  ce  Nets.  In  this  paper,  we  develop  two  algonfhms 
for  the  optimal  selectio?is  of aerfom,  ^'ve/i  a  .ssr  of preconditions.  A  special  case  for  the  two  algo¬ 
rithms  is  laijD  considet‘ed  wftep'e  riie  jefeen'DR  of  actions  is  fiirther  constrained  4'_v  the  use  of dependencies 
among  them.  The  two  algonthms  are  based  on  two  diffei-et^it  CJjjJtmrrflfion  criteria:  one  ma:ttmizes  the 
p}-obabtlity  of  a  given  set  of  ?ifTr^ef  effects,  witife  the  other  maximizes  the  -ervera^^  worffi  of  the  effects' 
vector. 

Pevzetek:  Predstavljef^a  jfii  afgorftma  za  optimizaeijo  aArjj  v  crajovTio  Drfv’jjnrif  wrefaft. 


1  lufrodiiction 

We  consider  die  scenario*  where  a  sequence  of  actions 
need^  to  be  initialized  towards  the  mateiializing  of  some 
desirable  effects.  As  depicted  in  Figure  1,  each  action  is 
supposed  by  a  set  of  preconditions  and  gives  rise  to  a  set 
of  effects'  the  latter  become  then  the  preconditions  of  the 
following  action(s)  which,  in  tiun,  sh'es  lise  to  another 
set  of  effects.  Such  sequential  evolution  of  actions  is 
tenned  Activation  Timed  Influence  Nets  (ATINs),  wheie 
the  action  peiformers  may  be  humans.  ATINs  are  an  ex¬ 
tension  of  an  eai'her  fointahsm  cahed  Timed  Influence 
Nets  (TTNs)  [6-12,  20-27,  30.  31]  that  integiate  the  no¬ 
tions  of  time  and  uncertainn'  in  a  network  model.  The 
TIN.v  aie  comprised  of  nodes  that  represent  propositions 
(i.e.,  pre-and  post-conditions  of  potential  actions  as  well 
as  asseilions  of  events  which  may  indiiectly  describe 
such  actions),  connected  T.ia  causal  links  that  represent 
relationships  between  the  nodes,  without  any  expheit 
representation  of  actions.  TDSTs  ha\'e  been  experimen¬ 
tally  used  in  the  aiea  of  Ef^cts  Eased  Operations  (EBOs) 
for  evaluating  alternate  courses  of  actions  and  their  effec  ¬ 
tiveness  to  mission  objectives  in  a  variet^^  of  domains, 
e.g.,  wai'  games  [20-22.  25],  and  coalition  peace  opera¬ 
tions  [24.  27],  to  name  a  few.  A  number  of  anal^lkal 
tools  [6-12,  23,  24,  27,  30]  hax-e  also  been  developed 
over  the  years  for  TIN  models  to  help  an  analyst  update 
conditions.'as-seitions,  represented,  as  nodes  in  a  TIN,  to 
map  a  TIN  model  to  a  Time  SHced  Bayesian  Ketwork  for 
incorporating  feedback  evidence,  to  deteimiiie  test  set  of 
pre-conditions  for  both  timed  and  un-timed  versions  of 
Influence  Nets,  and  to  assess  tempoial  aspects  of  the  in- 


‘  TliiE  Pr'nrli  wa?  ETi|jpartfid  by  the  .Air  Fore#  Office  of  Scienlifijc 
KeEEarcb  (AJOSR)  under  Giants  FA9550-05-1-01M  and  ¥AS550^5- 
1-03SS. 


fluence.s  betw-een  uod^.  A  recent  work  [31]  on  TENs, 
underlying  constructs  and  the  computational  algorithms, 
provides  a  comprehenshne  analytical  undeipinning  of  the 
modeling  and  analysis  approach. 

r-w1  Tlfhit  71^4  2  TM4H-1  Tl'M-tf 


e:  pITb^s 

Figure  1 :  Network  Representation  of  an  Activation 
Timed  InQuence  Net  (ATTN) 

In  contrast  to  their  predecessors  {i.e.,  TlNs),  x^TENs 
explicitly  incorporate  as  nodes  the  andi'or 

actions  that  are  responsible  for  changes  in  the  slate  of  a 
domain:  other*  nodes  represent  preconditions  and  e:&ct3 
of  actions.  A  set  of  preconditions  may  suppoil  a  number 
of  different  aclions.  each  of  w'hich  may  lead  to  the  same 
effects,  with  different  probabilities  and  difierent 
costs.-’awards,  however.  The  objective  is  to  select  an  op¬ 
timal  set  of  actions,  ■bL^here  optimality  is  determined  via  a 
pre-selected  performance  criterion.  In  this  paper,  we  pre¬ 
sent  tw'o  algorithms  %vhich  attain  such  an  objective.  We 
note  that  an  effort  to  develop  an  action  selection  algo¬ 
rithm  k  also  pre  sented  in  [1]. 

The  erganizatioQ  of  the  paper  k  as  follows;  In  Sec¬ 
tion  2.  we  present  the  core  formalizatiou  of  the  problem. 
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mcludina  dififeieni  optimizatiou  ■ciiteiia.  In  Section 
3,  we  deriiie  the  two  algoritlims  w’hich  addiess  ttie  latter 
critei-ia.  la  Section  4-.  express  the  esteniions  of  the 
two  alaorithms^  to  the  netu'ork  propagation  scenario.  In 
Section  5,  we  inchide  numerical  e\^lii3tions  while  in 
Section  6,  we  dmw  some  conclusions. 

1.1  Related  Work 

ATINs  include  action  planning.  In  tbe  domain  of  ac¬ 
tion  planning,  classical  planners  assume  that  the  effects 
of  an  action  are  known  with  certainty  and  generate  a  set 
of  actions  that  will  achieve  the  desiied  goals  [19].  Some 
planners  do  moniror  for  errors  as  actions  are  execiifed. 
but  no  action  adaptations  are  incorporated  [29].  Other 
planners  :^stgn  probabilities  to  the  effects  of  actions  [2, 
13,  14,  16,  2S],  but  pioride  no  mechanisms  for  reacting 
to  changes  in  the  environment.  Reactive  planners  [5,  1 5, 
17,  I  S]  are  designed  to  select  and  execute  actions  in  re¬ 
sponse  to  the  current  state  of  the  world,  but,  with  a  few 
exceptions  [3],  [4],  they  do  not  use  probabilistic  infoima- 
tion  to  determine  the  hkelihood  of  success  of  the  actions. 
In  [1],  probabihsric  information  is  used,  in  an  effort  to 
deal  with  environmental  uncertainties,  but  no  optimal 
action  selection  strategies  are  considered  and'br  pro¬ 
posed. 

The  ATTN  formalism  in  this  paper  is  similar  to  an 
earlier  wort  by  Sugafo  Baghci  et  al  [1]  on  planning  under 
uacerTaiIl^y^  The  similarity,  howeier,  stops  with  the  graph 
representation  of  preconditions,  actions  and  their  effects. 
Simitar  parallels  can  also  be  drawn  with  other  graph- 
based  planning  approaches,  e.g.  GraphPlan 
(httpi.vwTvwf  .cs  .cniu.edu''-avrim^''graphplan.htmi).  The 
approach  in  this  paper  represents  a  new  formalism  and  is 
based  on  well  established  statistical  results. 

2  Problem  formalization  -  core 

In  this  section,  we  consider  a  modulai'  core  problem.  We 
initially  isolate  a  single  action  with  its  supporting  pre¬ 
conditions  and  its  resulting  effects,  as  depicted  in  Fig.  2 . 


prtcsaicStrtns  effects 


X  I  =  [Xi... Xaf  ^3l3e  status  random  vector  of  the  pre- 
conditions,  where  Xj  =  1 ,  if  precon¬ 
dition  Ci  is  present  and  Xj  =  0  if  pre¬ 
condition  Ci  is  absent.  xj  denotes 
binary  vector  value  realizations  of 

x"-’ 


=|Tu...,Yj’' 

The  status  random  vector  of  the  ef¬ 
fects,  where  Yj  =  1,  if  effect  e,  is 
present  and  Y,  =  0  if  effect  e^  is  ab¬ 
sent.  y^  denotes  binary^  ’V'ector  value 
realizations  of  Y ,  . 

Pi(x?) 

The  probabilrty^  of  success  for  action 
aj,  gri-en  that  the  value  of  the  pre¬ 
condition  status  vector  is  x  J  ; 
Ptjuccfj:!  fbr  action 

The  probability-  that  the  value  of  the 
effects'  status  vector  is  y^, 
that  the  action  aj  is  taken; 

"  1 

The  probability^  that  the  value  of  the 
effects'  status  vector  is  y'J,  given 
that  no  action  is  taken; 

PEj'"  I  no  action  tak^} 

The  utility^  of  the  value  of  the 

effects'  status  vector;  when  action  a^ 
is  taken 

m-v 

The  utility^  of  the  value  y“  of  the 

effects '  status  vector,  when  no  action 
is  taken 

We  note  that  the  utility  function  measures  the  net 

worth  of  the  effects'  vector  value  when  action  a:  is 

^  1  i 

talceu;  thus,  T^j(y™)  is  computed  as  the  w^orth  of 
minus  the  cost  of  deployment  for  action  aj. 

Let  us  now^  assume  mutually  exclusive  actions, 
which  are  supported  by  the  same  preconditions.  To  lead  to 
the  same  set  of  effects  (as  shown  in  Fig.  3).  Let 
{aj}i^:5i(  be  this  set  of  actions  and  let  X  land  denote 
the  common  status  random  vectors  of  preconditions  ver¬ 
sus  effects,  respectively.  Let  die  utilit>^  functions  for  each 
action  in  the  set  {aj}E^  be  nonnegath-e;  let  also 
be  noonegative. 


We  now  state  multiple  versions  of  the  core  problem- 
based  on  tw'o  different  optimization  criteria.  Problem  la 
and  3b  are  the  constrained  versions  of  the  first  two  prob¬ 
lems. 
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PtYfblem  1  {OptfjTial  Path  Froble.fn) 

Given  a  preconditions  vector  vahte  X  j  ,  given  an  effects 
vectoi  value  y^T  to  maximmn  piobabilit].^  action 
that  connecti  them.  Tliat  is,  find  the  action  that  maximiz¬ 
es  the  conditional  piobabiJify  P{y^  1 . 

Fj'oblem  J  /Aver^rge  L'b’lin'  Mtiximiia/ibni 

Given  a  preconditions  wctor  \ialtje  X  J ,  find  the  action  or 

actions  that  maximize  the  effects'  average  utility. 

F?'obfe?n  f  Conjfrajfre-d-jftfQm.J 

Given  a  preconditions  vector  \'alue  X  j  ,  given  an  effects 
vectoii'  value  y“_  and  an  action  dependency  matris-  find 
the  maximum  piobabilitY  action  that  conoecH  them.  That 
is,  find  the  action  diat  maximizes  the  conditional  proba¬ 
bility  P(y^  I  ^  i)  ■  ^  tos  case,  only  those  action  combi¬ 
nations  aife  comidered  that  are  allowed  by  the  constiaints 
in  the  dependency  matrix. 

Problem  3b  {Average  Utility  Maximization  M7ffe  Coh- 

^tmined  Actions} 

Given  a  preconditions  vector  I'alite  X  J ,  find  the  action  or 
actions  that  maximize  the  effects'  average  utility.  Ae  in 
Problem  Ja,  only  those  action  corobmations  aie  consi¬ 
dered  that  aie  allowed  by  the  constraints  in  the  depen¬ 
dency  matrix. 

Actiofi  Dependence'  Mat}±x  L4DM/ 

An  action  dependency  matris  is  a  tool  ’i^iiich  defines  de¬ 
pendency  among  actions  in  the  networic.  It  reduces  the 
number"  of  combinatioas  of  actions  by  considering  only 
those  allowed  by  the  dependency  matrix.  It  also  reduces 
significantly  the  amount  of  calculations  requited  to  ob¬ 
tain  the  optimal  path.  The  I'alue  of  the  variable  a^j  reflects 
the  existence  or  absence  of  dependency  bettveen  actions 
ai  and  where  a^j  equals  1;  for  positive  dependency  and 
equals  0;  for  negative  dependency,  and  1  <  i^  j  <  n ,  where 
'n'  represents  the  total  number  of  actions  in  the  uetwort. 
The  elements  of  an  ADM  are  detemrined  a  s  follows; 


1  ,  if  action  Biis  selected  for  execution 
in  leselZ,  then  aj  refers  to  the  action 
that  has  to  be  or  ha  s  been  selected 
for  execution  in  level  k,  viiiere  ^  k 


0  ,  if  action  a^  is  selected  for  execution 
in  level  1  then  a^  refers  to  the  action 
that  must  not  be  selected  for  execution 
in  level  k  istiere  I  ^k 


where,  level  I  in  an  AITN  corresponds  to  a  set  of  pre¬ 
conditions  (Cl,  C2...C1J  followed  by  a  set  of  actions  (ar, 
a^. .  .ai)  and  a  set  of  effects  (ei,  e^. . .  e^a)  (as  shown  in  Fig. 
3).  The  effects  of  this  le%ei  then  serve  as  the  pre¬ 
conditions  for  the  next  leT.el  f  + 1  and  so  on. 


3  Solutious  to  the  core  problems 

We  present  the  solutions  to  the  two  core  problems  posed 
in  Section  2  in  the  form  of  a  theorem,  whose  proof  is  in 
the  Appendix. 

Theorem  1 

a.  Gi\en  X|  ,  given  and  given  a  set  of  actions 

to  conditional  probability  P(y7  l^t)i^ 
maximized  as  follows: 

by  action  aj*,  if 

qj*(yT)P5*U?)  = 

qj(yT)B(x?)>q»(yT)  a) 

H.-liere  dieniiLL’c  P{y;  =qi.(y ")  pj.<xn 
by  no  action:  if 

q„(y“)>m^x  <iCy^)pj(xn  C2) 

where  then  max  P(y^  [x^)  =  q(y(  yT  J 

If  more  than  one  action  satisfy'  the  maximtun  in  (1), 
then  one  of  these  acticnii  mary  be  selected  randomly. 

b.  Gi^en  x  ”  ,  given  a  set  of  actions  and  given 

utility  fimctions  {Uj(y^“)  }i^  and  to  av¬ 

erage  utility 

U(0=Z  ZPC^i  takcn^y^^Ixp-UjCvp 

yf 

+  y  P(iio  action  tafciai| 

yr 


is  maximized  as  follows: 
by  action  aj*;  if 

Mxi)  =  V  <^.(y7)  uxyT)  = 

max  Pi  (x?)^  <i{yT)Ui(yT)> 

?■( 

Z  ‘to<yT)U,(y7)  (3) 

y° 

by  no  action;  if 

Z  q«(yT)^(yT)> 

T| 

Pjfx^Z  ^(y“3  Uj(y7) 

urn 

Aj»{  X  t )  in  (3)  is  to  awmd  assigned  to  action  aj*;  it 
is  also  the  worth  assigned  to  the  precondition  vector 
value  X  1  by  the  action  aj* . 

If  more  than  one  action  attain  the  maximum  award 
Aj*(  X 1 )  in  (3),  one  of  them  is  selected  landomly. 
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4  Solutions  of  the  netsvork 
propagation  pivblem 

In  ttiis  section,  we  ^eueralize  the  coie  pioblem  solutions 
eispnessed  in  ITieorein  1,  Section  3,  to  she  sequence  of 
actions  depicted  the  ATIN  in  Fig.  1. 

Problem  J  ^The  Oprimal  Path  Pt'oblefft} 

In  the  ATIN  in  Fig.  1,  we  fix  the  pieconditions  vector 
value  Xi(l)x  time  1,  and  the  effects’  vectoi  viai- 
ue  y  "J  (N)  -  at  time  K.  We  then  seaich  for  the  sequence  of 
actions  that  maximizes  the  probability  P(y^  (N)  |  xf(l'))- 
The  solution  to  this  problem  follows  a  dynamic  pro¬ 
gramming  approach  where 

X  =  y^(/-l);2<f<N,in  our  notation.  The  proof 
of  the  step  evolution  is  included  in  the  Appendix. 

Step  I 

For  each  y7  (1)  =  ^  i(2)  value,  find 

rC^-(l»  =iBiK[q,C^7(l)),npxq.Cv;a))Pi(x?  (1))] 

and  the  action  index  j*(  y "  (l j)  that  attains  r(y™  (1)} . 
Stepl 

A 

The  values  r^y^(f_l))  =  max  P(y^(f- 1)1  x”(l)),  ^ 
each  (^-1)  vialue,  are  in  memoty,  as  well  as  the  ac¬ 
tions  that  attain  them.  At  step  L  the  values 

rCy7(/))  =m2XT<y-^Q-i)}  X 

X  ma.\  [q^jCv^CO).  njaxqjCy^  (0)  Pj(y7  (;  -1))] 

are  niaintainjed.  as  well  as  the  sequence  of  actions  leading 
to  them. 

The  con^lexity  of  this  piob  lem  is  polvnomial  vifth 
respect  to  the  number  of  lints.  Assume  that  a  given 
ATIN  model  has  'N’  number  of  levels  and  each  level  has 
'k'  littkS;  then  the  complexity'  is  given  as  C2  (N  x  t). 

Probl,em  2  fThe  Avm'a^e  Utflify  Maximization) 

In  the  ATTN  in  Fig.  1.  u-e  fix  the  value  of  the  precondi¬ 
tion  vector  at  time  1,  denotedxi{l)-  For  each  value 
y™'  (N)  of  the  effects  vector  at  time  N,  vi'e  assign  w'orth 
functions  U  (yY  (N)) .  For  each  action  aj  (f).  at  time  1.  we 
assign  a  deploy^ment  cost  Cj  (f) .  The  utility'  of  the  effects’ 
vector  value  yY  (N)  ^  when  action  a,  (N)  is  taken  is  then 
equal  to  Uj  (y  Y  (N))  =  U  (y  Y  (^O)  "  ^ j  ,  while  the 
milily  of  the  same  value,  tvhen  no  action  is  taken. 
eqn.alsUu(y' Y  (N))  iu  (yY(^)  -  seeking  the 

sequence  of  actions  which  lead  to  the  maximization  of 
the  average  utility.  The  evolving  algorithm,  fiom  part  (b) 
of  Theorem  1,  back  propagates  as  follows.  The  proof  is 
in  the  Appendix. 


Step  1 

Compute  the  action  awards  (including  that  to  no  action), 
with  notation  of  Figure  1.  as  follows:  0  <  j  <  r; 

A,(x;CN-l))  ^ 

Pj(x!<N-l))  V  «^(yT(N))  Uj(yT(?^) 

77  m 

withpc  CxJ(N-l}}  =1 
for  each  Xi{K-l)  value. 

Take  action  for  preconditions  vector  value 

x((N-l)asd  simultaneously  assign  worth 
A  ,  (xf(N-l))  to  xi(N-l).  That  is,  assign; 

U<xi(N-l))  =  A^^^jj(x((N-l})  (5) 

.5?^^  2 

Back  propagate  to  the  preconditions  at  N-2,  as  in  Step  1, 
starting  with  the  w'orth  assignments  in  (5),  and  subse¬ 
quent  utilizations 

U^(xiCN  - 1))  =  - 1))  -  c^CN  - 1).0] 

M 

As  in  Steps  1  and  2  (for  subsequent  levels)  the  abo\e 
described  algorithm  generates  the  optimal  sequence  of 
actions  for  given  initial  preconditious  sY(l)  .  The  optim¬ 
al  such  preconditions  can  be  also  found  via  maximization 
of  the  utility'  U]  (  xi(2)),  with  respect  to  s  j  (1) . 

The  complexity  of  this  problem  is  also  pohTiomiaJ 
with  respect  to  the  number  of  hnfcs. 

Pt'oblems  Mirfr 

Problems.  3a  and  3b  impo-se  dependency  constramts  on 
the  actions  in  the  x\lTN  neh^-orfc.  As  explained  in  Sec¬ 
tion  2.  m  ADM  deiines  the  dependency  of  one  action  on 
every'  other  one.  where  positix'e  depend-ency  is  depicted 
by  1  and  negative  dependency  is  depicted  by  0.  The  de¬ 
pendency  constraints  aie  taken  info  account,  w'herL  at  a 
certain  level,  an  optLmal  action  is  finalized.  .At  any  given 
levneL  only'  positively  related  actions  are  considered  in  the 
calcitlatioos. 

As  desciibed  in  Step  1  of  Problem  1  (see  Section  4), 
for  the  first  level.  r(y^(l))  is  calculated  she  same  way 

for  conssrained  actions  also.  But  for  the  re-st  of  the  lev'els, 
it  is  calculated  in  a  different  manner. 

Consider. 

ity;;’®)  =max  ity7Cf-l))  x 

y-i  (J-U 

X  maxlq^(y^(0),  maKqj(y^  (0)  (/  - 1))] 

The  parameter  max  r(yY  (Nl))conespond.s  to  .an  ac- 
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tkm  selected  for  execution  in  level  /  - 1 .  Its  dependent 
actions  can,  be  &om  the  ADM.  In  this  way.  those 

combinations  of  actions  which  are  not  allowed  by  the 
ADM  aie  ehminated  firom  the  caloitlatioii  of  r{y^(0)j 

hence  eiiminatmg  all  links  to  and  &om  the  actions  exhi¬ 
biting  negativie  dependencies.  As  a  result  of  which  it 
yields  a  netvi^ork  with  lesser  number  of  links  and  eases 
the  determination  of  optimal  sequence  of  actions. 

5  Numerical  evaluations 

In  this  section,  we  focus  on  nunieiicaJ  scenarios.  We  first 
state  the  experimental  seli^.  We  then.  eT.'aiiiate  and  dis¬ 
cuss  a  specific  experimental  scenario.  We  only  state  the 
experimental  setups  for  Problems  1  and  2,  since  those  of 
Problems  3a  and  3h  are  shaighl  foiward  modifications  of 
the  former. 

5.1  Experimental  Setups 

Senip  for  Ff'oblerfi  1 

Assign  the  probabilities 
{qj(xJ  (i))}  .Tiid  {pj(x^  (/))}  as  in  problem  2. 

Given  these  pi  obabilities: 

a.  Confute  fust: 

rCv"<l))  imax[q,(>-{l)).i]iYS  q,<y7(l))Pj{x^(lWj 

and  the  action  j*  ^  (l))that  attains  (1))- 

b.  For  each  [ :  2  <  /  <  N.  maintain  in  memoiy  the 

ues  r(y^  - 1))  =  max  P  (y^  (/  - 1)  |  x  j  (1)) ,  for  each 
y*^(^  -1)  value,  and  the  actions  that  attain  them.  Then,, 
compute  and  maintain  the  values: 

r(y7(/))=maxr(y7(M))  x 

X  msx  [q^Cy"(/)),  I^qi(y7  (0)  PjCvT  -1))] 

Also,  maintain  the  actions  that  attain  the  val- 

ues  r<y7(0)  ■ 

Erpgn'mgnrQf  .Sgfijp /or  Prob^c??i  2 
Considering  the  netw'orfc  in  Fia.  1.  assign: 

a.  Worth  function  U(y'(N))for  all  y^(N)  values  of 
the  effects"  status  vector,  at  level  N. 

b.  Probabilities  qj(xS‘  (f))= 

P(x^  {/)  ocemring  [  action  j  at  step  I  -  1)  at  all 

levels,  2  to  N, 

,  i 
wtee  q,(xj  (i))= 

P(Xi  {/)  occurriag  |  no  action  j  at  step  ^  -1)  at  all 
levels,  2  to  N, 
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c .  Probabilities  pj(  Xv  (/) )  = 

P(action  j  succeeds  |  xf  (f) preconditions)  at  all 
le^^els.  fiom  1  to  N-1, 

where  pc  (xf  (i))  =  1;  V  i 

d  Impknaentation-deployinent  costs  Cj  (i)  for  all  ac¬ 
tions,  at  all  levels  2  to  TS". 

Given  the  above  assignments. 

a.  Compute  first, 

A.(Ki(N-l))  = 

I^{x[{N-l))  y  qj(y-<N))  Uj(y-(^) 

yrCN) 

where. 

Po(x{tN-l))  =1; 

Uj  (yr  CN)  )  =  max  lU(yT(N))  -  Cj{N).  0] 
for  all  xJ(N-l)v^lues. 

b.  Take  action  a  for  each  precondition  vec¬ 

tor  value  XgfN-1)  - 

.'Usign  worth  u,-_i jjCxl (N - 1 ))  to (N - 1 ) .  as 

Repeat  steps  (a)  and  (b)  for  lev^el  K-1  and  back  prop¬ 
agate  to  level  F7-2.  Continue  back  propagation  to  level  1 . 

5 .2  A  Specific  Exp  eiime  ntal  Sceua  rio 

In  this  sectiodo-  we  illustrate  the  use  of  Activation  Timed 
Influence  Nets  with  the  help  of  an  example  ATTN,  and 
present  the  results  of  the  algorithms  included  in  this  pa¬ 
per.  when  applied  to  this  ATTN.  The  model  used  in  this 
section  was  derived  from  a  Timed  Lnfluence  Net  pre¬ 
sented  in  Wagenhals  et  al.,  in  2001  [27]  (which  was  de¬ 
veloped  with  the  help  of  a  team  of  subject  oaatter  experts) 
to  address  the  inleinal  political  instabilities  in  Indonesia 
in  the  context  of  East  Timor.  For  purposes  of  results  illu¬ 
stration.  we  have  selected  a  part  of  this  netwenrk,  as 
shown  in  Fig.  4. 

Example  ATI^': 

The  model  provides  detailed  information  about  the 
religious,  ethnic,  go\-emmental  .and  non-gov'einmental 
organizations  of  Indonesia.  In  this  section,  the  proposi¬ 
tions  and  actions  refeired  are  given  in  ttaUc  text.  Accord¬ 
ing  to  the  model,  rebel  militia  formed  by  a  minority^ 
group  poses  the  main  concern  which  has  captured  a  large 
rrumber  of  people  under  its  secured  teiiitory.  .Amongst 
these  people  in  the  conmunity,  some  are  against  the  re¬ 
bels  and  considered  to  be  at  risk,  in  case  the  negotiations 
with  the  local  goiemment  didn't  work  For  this  exauaple. 
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consider  the  initial  conditions  when  rsbet  ars  getting 
iofdl  die  common  !fi.=  is  in  and  (he 

aifmjn/jSf'ia/zon  is  losing  eontt~oL  Based  on  the  data  pro¬ 
vided,  only  one  action  can  be  executed  h-om  a  possible 
set  of  actions  at  a  given  rime  i.e.  either  of  the 
press  or  prevfncfol  mithoiit}'  or  the  of  interior 

wo^^^£f  rajoiw  to  keep  peace.  Depending  upon 

this  selected  action  and  the  data  provided  for  the  effects, 
only  a  specific  set  of  events  can  result.  For  instance,  re- 
m^ay  or  rrirrf  thinking  that  are  getting 

publicity^  GOT  {original  anti- government  of  Indonesia/ 
war  Iff  or  may  not  expand,  GDI  of  intervention 

and  international  attention  may  increase  or  decrease. 
Similarly,  this  specific  set  of  events  forms  the  set  of  pos¬ 
sible  pre-conditions  for  a  later  time.  Depending  upon 
which  conditions  actually  become  true,  second  action  can 
be  selected  for  execution  fiom  another  set  of  actions,  i.  e. 
.S&ci/rffj'  Couwcfi  and  Gonom/  may  or  not 

pass  resolutions  or  UN  or  moj'  not  declare  naioJve  to 
keep  peace.  Depending  upon  this  action  and  the  data  pro¬ 
vided  for  the  effects,  coalition  or  nor^™,  }-e- 
bels  mm-  or  may  not  contemplate  talks,  GOI support  may 
inoreose  or  decrease  or  may  not  ina'ease  at  aifF  or  GGJ 
may  or  mm'  allow  coalition  into  territories.  Ulti¬ 
mately,  the  coalition  may  authorize  use  of  force  which 
might  con^jel  rebels  to  negotiate  and  the  humirnelarfa/f 
assistance  (HAi  mr^’  start  preparing  for  the  case. 

Depending  upon  which  conditions  meet,  the  confifr-on 
declare  resolve  to  heep  peace  or  wa£r>=  declare  war  on 
i-ebels.  This  may  affect  the  chances  of  mifir?5:ir}-'  confronta¬ 
tion,  rebels^  populajity  and  of  negotiated  settle¬ 

ment  which  represents  the  final  effects  in  the  network. 

Table  1  lists  sonae  of  the  parameters  (and  their  val¬ 
ues)  tequired  the  network  in  Fig.  4.  The  parameters  in 
the  table  are  listed  by  their  abbreviated  labels  also  in  ad¬ 
dition  to  the  phrases  shown  inside  the  network  nodes  in 
the  figure.  For  the  sake  of  bievit^\  w^e  do  not  hst  aU  the 
values. 

Solution  to  Problem  I  {Optimal  Path  Problem): 

Consider  the  example  scenario  described  earher,  we  need 


to  identify  an  optimal  path  (i.e..  the  sequence  of  ac  tions) 
resulting  into  the  final  effect  when  military  confrontation 
chances  are  reduc^ed,  while  start  losing  local  sup- 

pKirt  and  negotiation  chances  start  increasing.  This  set  of 
effects  (post-conditions)  leads  to  the  following  output 
state  in  the  .4TIN  model: 

JJedEJf in  chances  of  militarir  confrontation 
Ci.e.  Yi::  =  0) 

in  local  support  and  populiirit\’' for  Rebels 
Ci-e.Yi5=l) 

Increase  in  chances  of  negotiated  settlement 
(i.e.YH=l). 

The  above  defined  conditions  lead  to  a  post¬ 
condition  vector  [0,  L  1]  ^  at  level  4,  i.e.  y  p{4)  . 

Affer  fixing  the  post-condition  vector,  we  define  the 
initial  preconditions,  when  rebels  lfa\=e  been  getting  local 
support,  the  rnmnrEjnrlj.^  IfiiE  £necn  e>!  unfiarf  and  the  foctif 
fl’iJjwjHjjnnfTon  has  staged  control.  This  set  of  pre 

conditions  given  by  Xi  (1)  results  into  a  vector  value  of 
[1,  1,1]^,  where 

Xi  =  li  represents  the  condition  Rebels  are  getting 
Loc:al  Su^aii- 

X]  =  1:  lepiesents  the  condition  Thert  li  in 

the  Commimity 

X3  =  1 ;  represents  the  condition  Local  Administra¬ 
tion  is  Local  Control. 

We  w^ant  to  find  out  die  sequence  of  actions  which 
achieves  the  desired  effects  yi3(4)  given  the  initial  pre¬ 
conditions  sj  (1).  Technicaliy,  w-e  w^anf  to  identify  the 
sequence  of  actions  w^hich  maximizes  the  probabd- 
ify  PfyjJ  (4)  [xj(l))  .  Applying  the  optimal  path  algo¬ 
rithm  (.see  Section  4)  resailts  that  if  thej^ravincrai  author¬ 
ity  and  declare  resolve  to  keep  peace  and  coalition 
does  not  take  aMy  action,  instead  if  declares  resolve  to 
keep  peace,  then  the  de.siied  effects  will  be  achieved 
which  vi^ill  result  into  less  chances  of  military  con/ron  ta- 
fron,  reduction  in  local  support  for  rebels  and  more 
chances  of  a  negotiated  settlemefit. 


Figure  4:  Example  ATIN. 
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Table  1:  Parameter  values  In  Uie  EKample  AT1W 


Le\elL 

Y1 

A£dm  aj 

q/yf) 

x; 

p,(s.L) 

PiCxi)*q  A'  1 ) 

r{yt) 

c;;; _ , 

IndoQjKiaai  press 
decEara  to  ke^ 

peace(al) 

6£.tm 

6.45% 

£0.00% 

54,.4Qf^i 

63.64% 

Provincial  Anthoritv 
decLaffii  tesobeto  ke«5 

74.0TO 

56.00*4 

63.64% 

peace  (a^) 

Minister  of  interior 

rsaotva  to 
peace  (a3) 

36.  cm 

20.00% 

11.20^0 

Li!>£]2 

y! 

aj 

qj(y?) 

q.(y*) 

xl 

p,<?i  D 

PjCx;)^q(y?) 

Tiyl) 

ResolutiGa  Is  passed  in 
Secudty  council  Ca4) 

14.  om 

[0,0,C?,0]^ 

16.00% 

2.24% 

34.  om 

[1:^1, 1]'^ 

3l6o% 

12.74% 

[1,1,1,11^ 

1S.0Q% 

2.5m 

UN"  dedaies  tescJve  to 

te^  pace  Ca3) 

AZQty^h 

0.95% 

[0:0,0,0J" 

S6.O0% 

27.7m 

... 

fl.0.1.lF 

£1.00% 

34.02% 

luTF 

'‘™™?639r™™ 

Resohiticn  is  passed  m 
Gaieral  Assemfcih  (a6) 

39.0GPA 

43.0??4 

1679?-^a 

[1.0.1, 1]’' 

4S.20% 

IS.SQfJi 

2A.^7% 

9.7Cy?-i 

Levi  3 

AfiticQ  ^ 

q/y  y) 

vU  1 

pj(s  ;•) 

P,Cx")  *q,{y  “) 

E-, 

Coaliticffl  Autliorizes 
tlteUse  of  Force  (tTJ 

43.  cm 

53.00% 

(No  Action) 

[0.0,0,01^ 

0.00% 

0.00% 

59.00% 

[i.o.i.i]’' 

64.00e4 

27.52% 

[1.1.1, l]‘ 

IS.00% 

7.74'% 

L£>e]4 

Action  aj 

qi(yr) 

q.(yr:) 

■T  7-  H 

12 

PiU")  *q,(y;0 

Ky  li ) 

_ 

Ccaiitittt  ■dedares 

1. 50^-4 

[o.aor 

16.00% 

3.36% 

19.11% 

resoK  atoksp  p-bbce 

m 

[laop 

31.00?-o 

1911% 

[i,i,ir 

[o.o.or 

3S.0D% 

7.Q8^i 

CoaJitioti  declftf^  wtir 
on  rdbds  (a9) 

IT.OC^d 

[lAor 

18.43?'^ 

3.14% 

[i44r 

30.^S^b 

5.25% 
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The  details  of  ftiis  lesmlt  ane  givea  in  Table  1 .  It  only 
coutakis  ttie  \ialues  thaT  correspond  to  the  selected  ac¬ 
tions  at  their  respective  levels,  while  a  complete  set  of 
probabilities  has  bear  lised  to  calciilafe  the  actual  final 
sequence.  Hie  optimal  actions,  iheir  corresponding  state 
vectors  and  the  probabilitie&  are  imderhned  in  the  table. 
The  Optimal  Path  algorithm  is  of  d^ynaniic  prograrnming 
nature,  so  it  requiies  two  traversals  to  finalize  the  se¬ 
quence  of  actions.  Ehning  the  forward  traversal  r(y”  )is 
calculated  for  each  level  for  all  possible  post-condition 
combinations.  At  the  last  level,  the  post-ctondition  vector 
y^^{4)is  fixed  to  be  the  desired  effect  of  the  networi: 

which  is  [0,1.11^  as  determined  earlier-.  The  best  action 
associated  mth  this  post-condition  vector  is  identified 
along  with  its  pre-conditiou  vector  x|2(4)  -  Using  this 
pre-condition  vector  (which  is  the  post-condition  vector 
of  the  second  last  level),  the  network  is  traversed  in  re¬ 
verse  diiecrion  identifying  actions  and  their  coriespond- 
ing  preconditions,  fiom  last  to  the  first  level.  The  action 
at  the  fii'sr  level  is  identified  by  fixing  the  pre-condition 
to  the  value  determined  earlier,  i.e.  xj(l)  which  is 

[1,  1,  1]  Completing  both  forward  andrevei'se  travers¬ 
als  gives  the  optimal  actions  which  achiei'e  the  desired 
effects  when  the  initial  causes  ate  given. 

SoiwUon  to  Pnp&^c?^]  2  Utility  Maximiiafion): 

Consider  a  scenario  where  we  need  to  identify  the  se¬ 
quence  of  actions  which  maximizes  the  effects^  average 
utihty  (at  level  4)  for  the  same  input  pre-condition  as  it 
was  used  in  the  solution  of  Problem  i,  i.e  [1.  1,  II  i 
xAssume.  that  the  depIo;yTiieut  costs  for  actions  and  ag 
are  25  and  30  units,  ^e&pectivef^  The  worth  of  each  ef¬ 
fect  in  the  last  level  (i.e.  level  4)  is  given  by  the  worth 
function  values  U(y|^(4))  gi\ien  in  Table  2  and  3.  Each 

effect  also  has  a  net  utiHly  which  is  determined  by  sub¬ 
tracting  the  deployment  cost  of  the  action  fi-om  the  worth 
of  the  effect.  This  net  utihty  Uj(y^t(4))(when  action  aj  is 

taken)  and  the  action  awards  are  given  in  Tables  2  and  3. 
The  action  award  is  calculated  for  each  action  coire- 
sponding  to  all  of  its  pre-conditions.  Similarly,  these  cal¬ 
culations  are  performed  for  the  rest  of  the  actions  in 
ATTN  model  (affei-  costs  are  assigned  to  e\Tery  action  in 
the  model),  but  for  the  sake  of  bre^ify  only  the  results  for 
actions  ag  and  ag  are  shown  in  Tables  2  and  3.  respec¬ 
tively. 

As  described  in  Section  4.  the  action  aw-aid  is  calcu¬ 
lated  for  all  actions  in  each  level.  For  instance,  starting 
fifom  the  last  level,  the  action  awards  are  calculated  for 
actions  aj  and  ag.  The  selected  action  is  the  one  which 
maximizes  the  average  utihty  and  its  action  index  'j’  is 
recorded.  As  each  action  atvard  is  calculated,  it  is  also 
assigned  as  the  worth  function  To  the  previous  level  ef¬ 
fects  T-yector.  The  latter  worth  function  is  used  to  calculate 
the  utilities  at  fhe  previous  level  and  calculations  Me 
repeated  similarly.  This  procedure  is  back  traven^ed  fiom 
last  to  first  levels.  Table  4  summarizes  the  action  awards 
of  those  actions  which  maximize  the  effects'  average 
utihty  at  theii-  respective  levels . 


Table  2;  Utility  Functions  and  Action  awards  for  Ac¬ 
tion  38 


Lei  el  4  -  .lerion 

x:{4) 

ucv;;(4)) 

[0,0,0]' 

16.00^/a 

[0,0, Oj’- 

37.0ffl4 

40 

15 

il.ll 

[0.0,  if 

24.00“/^ 

[0.0.1]' 

65.00^4 

30 

5 

16.66 

[0,1.01’ 

75.00% 

[0.1,0]'' 

53.00P4 

60 

35 

52.07 

[0.1.1]’ 

S5.00% 

[O.l.lf 

21.00^4 

79 

54 

59.02 

[L0.01’ 

91.00^-i 

[l.O.fll'' 

le.ow 

41 

16 

11.11 

[1.0,1]" 

72.00% 

[lAU' 

43.00P4 

65 

40 

49.99 

[Ll,0l" 

16.00% 

[1,L0J'' 

29.00^4 

37 

12 

63.  IS 

[l,l,ll’ 

3S.O0% 

[1.1,1]'' 

2700^4 

51 

26 

26.3S 

Table  3:  Ltihn^  Functions  and  Action  awards  for  Action 
a9. 


Level  4  —  Af  doo 

x;'(4) 

YllW 

uCstX^)) 

Uj(ji3C4)> 

10,0.01'' 

67.00*4 

41.00% 

40 

10 

43.25 

[o,o,ir 

97.15*4 

[0.0,1]’ 

26.00t4 

30 

0 

69.96 

[0,1,0]' 

5S.29ri 

[0.1.0]’ 

71.00*4 

60 

30 

41.97 

[0.1.1] ' 

13.00% 

[0,Llf 

1700% 

79 

49 

9.36 

[1,0,0]’ 

1S.4S% 

[1.0.0]’ 

26.00^4 

41 

11 

13.31 

[To,ir 

39.28% 

[lAlf 

54.00r‘i 

65 

35 

23.29 

[i,i,or’ 

3S.67^i 

[1.1.0]’ 

62.00ftt 

37 

7 

27.35 

[1,1,1]’ 

30.3S% 

[1,1,1]'' 

5S.OO^‘;d 

51 

21 

22.24 

From  Table  4  it  can  be  seen  that  the  sequence  of  ac¬ 
tions  that  maximizes  the  effects'  average  utihty,  obtained 
as  a  result  of  applying  the  algorithm  is  given  b^y;  ai  (i.e. 
Indonesian  press  declarer  resolve  to  keep  peace),  (i.e. 

is  passed  in  General  a^  (i.e.  Coirif- 

tian  iiuf^Torizes  of  Force),  a^  (i.e.,  Coalition  declares 

on  j'obe'ii) .  The  underliued  entries  in  Table  3  cones- 
pond  to  the  worth,  utihly^  function  and  action  aw-ard  of 
action  ag. 

To  Probiem  3a,  3b  (Constrained  Acttons): 

The  dependencies  among  the  actions  in  the  example 
ATIN  model  are  defined  in  the  action  dependency  matrix 
given  in  Figure  5. 

Most  of  the  dependencies  givsi  in  the  mati'ix  are 
quite  evident.  For  mstance,  the  peace  resolution  declara¬ 
tion  by  UN  (as)  ensures  that  either  of  Indonesian  press, 
pt'ovincial  autkority  or  fninister  of  mns/  flfjo 

declared  ike  resolution  to  kei^  peace  (either  of  ai 
or  aj  or  Ug  must  have  been  executed  in  the  past)  which 
would  represent  the  opinion  of  the  bcals  in  general.  Si¬ 
milarly.  resolution  passed  4^-  the  Secutify  Council  or 
General  Assembfy  (aj  or  a*)  makes  sure  that  wh  ether  or 
not  the  coalition  wiYJ  have  to  aufhoiize  the  use  offeree 
(a-):  considering  the  lesolution  is  in  support  of  use  of 
force.  This  infers  that  if  rJte  coalition  authotiies  tke  uje 
offeree,  it  will  declare  Wiir  on  Rebels  othemyrse.  it  wdi 
declare  resolve  to  keep  peace.  All  of  these  dependencies 
can  be  observed  ffom  the  ADM  (as  shown  in  Fig.  5). 

Consider  a^^  in  ADM,  (as  shovLTi  in  Fig.  5)  which 
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coiTesponds  to  a  positive  dependetic}^  between  petice 
declaration  by  the  provincial  aiithonfy  (aj)  and 

by  UN  (aj).  The  ADM  suggests  that  there 
exist  negative  dependencies  between  action  33  and  ac¬ 
tions  a^.  tki-  a-  and  which  means  that  if  ajj- 

thohfy  declares  peace  resolution,  Secunty  Cornell  and 
General  Assembfy  wn 't  pass  resolution  and  fhe  Coali¬ 
tion  will  not  authorize  ffte  use  offeree  and  hence  will 
declaim  resolve  to  keep  peace.  This  knowledge  of  depen¬ 
dencies  &om  the  ADM  certainly  reduces  an  extensive 
amount  of  effort  in  calculating  the  optimal  path.  WTiile 
calculating  the  optimal  path,  during  the  forward  traversal, 
only  those  paths  are  considered  which  satisft-  the  con¬ 
straints  defined  in  ADM  ;ylelding  less  number  of  combi¬ 
nations  to  consider  for  calculation  and  making  it  easy  to 
back  traverse  and  identi^^  the  optimal  actions. 

The  :same  applies  to  the  sohttion  of  the  second  prob¬ 
lem  of  idenlifying  sequence  of  actions  maximiziiig  the 
efiGects’  aT-nerage  utilit}-  under  constraints.  The  action 
aw'ards  are  calculated  for  those  actions  only  which  satisfy 
constraints  defined  in  ADM.  and  hence  reducing  the  ef¬ 
fort  of  calculating  action  awards  and  assignment  of  w-oilh 
function  at  each  level. 


Table  4:  Action  Awards. 


Level  1 

Leiel  2 

L  ev  el  3 

Let  el  4 

AaCxl;(4» 

151.02 

SS.IS 

77.92 

6  C'ouclusiou 

This  paper-  presented  an  extension  of  a  Timed  Influence 
Net,  termed  ATTN  (Acth'ation  Timed  Influence  Net).  An 
ATIN  iitiEzes  a  set  of  preconditions  required  for  the  un¬ 
dertaking  of  an  action  and  produces  a  set  of  effects. 
These  effects  become  then  the  preconditions  for  the  next 
level  of  actionfs),  resulting  in  a  sequential  evolution  of 
actions.  Some  other  probabilistic  planning  techniques 
were  also  discussed.  The  paper'  identified  several  pre¬ 


selected  performance  criteria  regarding  AlTNs  (r.e.,  op¬ 
timal  path  and  average  utihty  maximi^tion  with  and 
without  constrained  actions)  and  recommended  algo¬ 
rithms  for  theii'  satisfaction.  A  tool  called  44DM  (Action 
Dependency  Matrix)  was  introduced,  which  induces  de¬ 
pendencies  among  the  actions.  It  is  represented  with  the 
help  of  a  m  X  m  matrix,  where  '  m  ’  represents  the  total 
number  of  actions  in  fhe  netw'ork. 

The  implementation,  of  the  suggested  algorithms  was 
illustrated  with  the  help  of  a  real  world  example.  The 
example  demonsti'ated  a  politically  unstable  situation  in 
Indonesia.  Sets  of  actions  preceded  by  preconditions  and 
followed  by  sets  of  effects  were  demonstrated  iii  the  form 
of  an  ATIN  Model  (see  Figure  4).  The  experiment  was 
foimulated  based  on  a  previous  Timed  Ihflueuce  Net¬ 
work  model  for  the  same  scenario.  The  experimental 
procedure  was  appHed  to  the  netw^ork  with  a  set  of  prob¬ 
ability  data..  Solutions  of  both  problems  were  discussed 
in  depth.  The  optimal  path  problem  required  the  know¬ 
ledge  of  an  initial  set  of  cause  s  (preconditions)  and  the 
final  set  of  effects  (postconditions).  With  the  he^  of  the 
algorithm,  an  optimal  sequence  of  actions  was  identified 
which  maxijnized  the  conditional  probability'  of  achiev¬ 
ing  the  desired  effects,  when  the  initial  conditions  were 
givMi.  For  the  sake  of  brevity,  only  significant  parts  of 
the  probability  data  used  were  shown  in  Table  1.  For  die 
same  scenario^  the  second  algorithm  yielded  a  sequence 
of  actions,  which  maximized  the  effects’  average  utility. 
The  solution  for  both  problems  w'as  con^rehended  in 
detail.  The  e-xperiment  was  repeated  with  constrained 
actions  considering  only  dependent  actions  as  defined  in 
the  Action  EJependency  Matrix  (see  Figure  5)  which  pro¬ 
duced  similar  results  and  required  lesser  effort  to  calcu¬ 
late  than  without  ADM. 
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Appeudix 

Proof  ofTlieoiem  1 

In  the  derivations  below,  the  following  considerations  are 
incorporated: 

1.  ElSects  are  dictated  by  the  actions  taken:  tlms, 
when  probabilities  are  conditioned  on  actions  and 
preconditioiis.  die  conditioning  on  preconditions 
drops. 

2.  By  probability  of  action  success,  we  mean  the  prob- 
abilin-  that  the  action  may  succeed,  given  the  pre¬ 
conditions.  The  final  action  is  selected  among  those 
that  have  positive  piobabilily  of  success.  The  prob- 
abilin^  of  action  taken,  given  that  the  action  may 
succeed  is  the  criterion  that  dictates  the  final  action 
selection. 

(a) 

P(y*  I  )  =  2]  PCvT,-ijtakeL,  |  )  + 

+  P{y'“,  no  action  taken  |  (1 .1) 

where 

P(y“,ajtaken  [  x^)  = 

=  P(y“  I  a  .taken,x“J  P(a^takeii  |  x^J)  = 

=  P(y^  I  ajtafcen)P(a|mfcen  |  x^)  = 

=  P(ajTakeiij  x^)q,(y7) 

=  [p(aj  taken,  succ  for  actiou 

-I-  P(ajlaken,  no  succ  for  action  [  x“)Jx 

=[  P(a.taketi|siicc  for  action  aj,  x^)x 
xP(5iu:c  for  action  aj[X|)-i- 
-hP(a^taken|uo  suec  for  action  a^  x‘j)>^ 
x  P(no  succ  for  action  ajfxi)  ]  q.(yT) 
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Command  and  Control  Research  and  Technology' 
Symposium. 

[31]  Zaidi  A.  K..  Mausoor  F.,  and  Papantoui-Kazakos  P. 
(October  2007).  "'Modeling  witi  Infliience  Net¬ 
works  Using  Influence  Constants:  A  New  Ap¬ 
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=  [  P(a  taken  i  SUCC  for  action  a^  x 
xP(succ  for  action  aj|x°)-h 
-hP(ajtaken  I  no  succ  for  action  a.j)x 
xP(no  succ  for  action  ajlx^)  JfljCy^) 

=  P(a -taken  I  succ  for  action  ar)x 
i<Pj(xi)qj(y“) 

{UsiiigP(;ijtakeii|  no  succ  for  action  nj)=o} 
Equating  in  (1.1) 

P(yTI^")  = 

^  ^P(ajTaken  I  SUCC  for  action  aj)x 

X  P j  I  )^j  tV'  1 )  -h  P  no  a  ction  taken  |  )  (1.2) 

where 

P(y“,no  action  taken  [  x^)  = 

=  P(y^  I  no  action  taken.  x“)  P(no  action  taken  |  x") 
=  P(y“  !  no  action  taken)  P(no  action  taken  |  x^) 

=  P(uo  action  taken  |  x^)q^(y“) 

=  P(no  action  taken,  no  action  succ  [  x  (y^  ) 
=  P(no  action  taken  |  no  action  succ)qo{y“^) 
{Usmg  P(no  action  succ  |x'^)=l} 

Eqiuiling  in  (1.2) 

P(y^';x])  = 

=  ^  P(aj  taken  j  succ  for  action  a j  (x\)qj  (y^ ) 
+  P(no  action  taken  |  no  action  succ )  quCy"^) 
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=> max  P(y^  | k\)  anairted  [ y f  (N - 1 ))  max  P(y f  (N-i)  |x°(l))  ] 

iequeice  of  acdiODS 

if  P(aj+takeD  I  succ  for  action  aj+)=  l, 

=  max 

forpj-Cx1)qj.(y“)=™  Pj<x^)qj(y^)>qc(y^) 

^  ^  ^  t  m^PCyf(N)[yfCN-l))  }  r(yf(N-l))  ] 

orhei^'ise.  max  ?(y  s  |  x  |)  arramed  a™ 

if  P(uo  action  taken  |  no  action  succ)  =  !,  wheie.  via  Theorem  1  we  have: 
for  Pj  Cx’l)q^<x“)  <  q^Cy”) 


(b) 


U(x1)=  y  yPCa;aken.y”  | x^l)  (y”) 

lijli  Tf 

+  ^P(ao  octiou  t;iken.  y’J  [  x°)  Uo(y“) 

T? 

=  V  y  P(y“  I  a -taken)  P(a.taten  |  x pU^Cy”) + 


niax  P(y?(N)  |  y?  (N  - 1))  = 

vOksr 

=  max [  max  Pj(y^  (N  -  l))qjCy^  {>0):  qo(y “(>0) ] 


ThuS;  via  substitution  piinciple.  we  obtain: 
r(yfCN))<^,^?Jr(yf(N-l))  x 


X  max{  13^  Pj{y"  {N  - 1))  x  (N)),  q,Cv"(K))  )  ] 

iijiif  with  equality  iff  the  y “  (N  —  I)  value  that  attains 

+  V  P(vT  I  no  action  takeii)P(no  action  taken  I  x^)  x  ^  ...  .  ,  ,  „ 

^  ^  ^  r\y“(N  — l))is  selected.  The  above  proves  the  general 

tep  in  the  network  propagation  of  Problem  1 . 


=  ^P(aj  taken  |  succ  for  action  3j.Jp.(x"5)x 
^  (y”  )^j  action  taken ;  no  action  3ucc)x 

T* 

n 

=>  max  U(x“)  attained  for : 

P(aj* taken  |  succ  for  action  =1; 

if  Pi*(x“)Xqi*CyT)f">(y^)  = 

*T 

pjW)ZqjCvi)Uj(yT) 

y"  j" 

P(no  action  taken. [no  action  succ)  =  l, 

if  Zq,(y?)u,cv^)>^  PjCOZqj(>'T)UjCv7) 

^  j  -  j  j 


Proof  of  the  Network  Propagiation  -  Problem  2 

Using  the  notation  in  Section  4-.^  Problem  2,  and  ^ia  the 
use  of  the  Theorem  of  Total  Probability  and  the  Baines 
Rule,  we  obtain: 

ultx  Su(yr  CN))P(yYCN)  |  x^}  (i))  = 

‘»qnBa]£4  of  icdixai 


m.Tx  s  U(yr(N))  y  P(yr(N), 

Sflqi-HLIfl  of  IctiODS  O') 


xf(N-l)|xf(l))  = 

=  max  I  U(y*-(N))  V  p(yw(n)| 

a<|J£Il£fl  of  aCtMtD=. 

!x{CN-i»P(xiCN-l)|x?(l))  = 

=  max  1  P(xi(N-l)|xUl))x 

afiqjaiiH  of  BCDMii 


Proof  of  the  Net^'ork  Propagation  -  Problem  1 

Using  the  notation  in  Section  4,  Problem  L  and  via  the 
Theorem  of  Total  Probability  and  the  Bayes  Rule,  vi'e 
obtain: 

r(y7(N))  =  mis  .  P(yT(N)[x|(l))  = 


X  y  U(yf  (N))  P(y  r(N)  |  x  1  (N  - 1))  = 
y7<m 

=  X  P(xi<N-l)lx?Cl))x 

mT-1) 


max 

sapimra  {if  adums 


Vp(y^,y-(N-l)lx?(l))  = 


max 

s&quaic  E  {>f  a-dum 


ZP(yT<N)lyf(N-i))x 

ntN'-l) 


The  latter  expression  proves  the  back  propagation  prop¬ 
erty^  and  the  steps  in  the  algorithm. 


xP(yf(N-l)|xi(l))<  max  [  maxP(yf(N)[ 

y^(U-S) 
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